{ "schema_version": "1.0", "generated_at_utc": "2026-10-23T02:18:09Z", "release_note": "What each company has published about PHP2Shell (CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 on 21 October 2026), read at the places checked and re-checked daily. Statuses follow the published rules; a secondary report never upgrades a row.", "rows": [ { "slug": "20i", "company": "20i", "canonical_domain": "20i.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.stackstatus.com/", "statement_date": "Wednesday, 21-Oct-26 20:01:53 UTC (first update 21-Oct-26 14:24:04 UTC)", "status": "patched", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (plus backported fixes for older PHP versions)", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://www.stackstatus.com/", "https://docs.20i.com/web-hosting/server-status", "https://www.20i.com/", "https://www.20i.com/blog/", "search:20i PHP2Shell", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:33:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "all PHP versions across all platforms are now fully patched against the recently disclosed PHP vulnerabilities.", "notes": "\"all PHP versions across all platforms are now fully patched against the recently disclosed PHP vulnerabilities.\" and \"All Cloud Servers have now been successfully updated.\" quoted from https://www.stackstatus.com/ (incident: PHP Security Updates, PHP2Shell Vulnerabilities, status Fixed; no permalink). stackstatus.com is 20i's status page per https://docs.20i.com/web-hosting/server-status (\"check the status of the 20i platform on the Stack Status page\"). Earlier: \"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are now available.\" (17:30:22 UTC); backported versions rolled out to Cloud Servers (18:51:16 UTC). No 20i blog post found.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "3pl-systems", "company": "3PL Systems", "canonical_domain": "3plsystems.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.3plsystems.com/", "https://3plsystems.com/news", "https://3plsystems.com/news/press" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or status page on 3plsystems.com. News page carries BrokerWare Release Notes dated 22 October 2026 (features and fixes, no security or PHP mention); newest press release 21 May 2026. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "8am-mycase", "company": "8am MyCase", "canonical_domain": "mycase.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:8am MyCase PHP2Shell", "https://www.mycase.com/security/ (fetch failed, client error)", "https://www.mycase.com/ (homepage, footer Security link goes to trust.8am.com, no status link, no notice)", "https://trust.8am.com/ (trust center, no updates or advisories section, no PHP mention)", "https://status.mycase.com/ (status page)" ], "last_checked_utc": "2026-10-23T02:07:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for Oct 20 and Oct 21, 2026 and \"No incidents reported today.\" for Oct 22, 2026, quoted from https://status.mycase.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "a2-hosting", "company": "A2 Hosting", "canonical_domain": "a2hosting.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://hosting.com/blog/protecting-against-php2shell-vulnerabilities/", "statement_date": "Written on October 21, 2026; Updated on October 22, 2026", "status": "patched", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.a2hosting.com/blog/ (redirects to https://hosting.com/)", "https://status.a2hosting.com/ (redirects to https://status.hosting.com/)", "https://status.hosting.com/", "https://status.hosting.com/incident/3174", "https://hosting.com/blog/", "https://hosting.com/blog/protecting-against-php2shell-vulnerabilities/", "search:A2 Hosting PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:05:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "A2 Hosting now operates as Hosting.com (a2hosting.com and status.a2hosting.com redirect to hosting.com and status.hosting.com). \"we have already handled the updates and there is nothing further you need to do.\" (managed plans) and \"these backported security fixes are already applied to earlier versions of PHP running on our systems.\" quoted from https://hosting.com/blog/protecting-against-php2shell-vulnerabilities/ (author Konstantin Kolarov; title: The php2shell PHP flaw: what it means for your website). Mixed: unmanaged VPS and dedicated customers must update themselves and \"restart all PHP workers and services.\"; \"PHP 8.1 and earlier no longer get regular fixes from the PHP project.\" (managed sites on 8.1 and earlier covered via CloudLinux Hardened PHP). Status incident https://status.hosting.com/incident/3174 (PHP Update): \"The PHP-related service update has been completed successfully.\" (Resolved Oct 22, 2026 17:02 CST, as read in a browser at 00:40Z); an earlier cached fetch showed the incident still Recovering at Oct 22, 2026 03:09 CST.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is A2 Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "A2 Hosting has addressed PHP2Shell and reports its managed-platform update complete; self-managed servers require customer action. A2 Hosting now operates as hosting.com, so its official status page is the relevant source. As checked on October 23, 2026: Affected? The provider’s security-update notice explicitly references CVE-2026-109618 and CVE-2026-109619 and describes deploying patches across its platforms. This confirms remediation was applicable,", "cited_urls": [ "https://hosting.com/about/news/?utm_source=openai", "https://status.hosting.com/incident/3174" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is A2 Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on my research, I was unable to find any public statement, advisory, or announcement from A2 Hosting specifically addressing PHP2Shell (CVE-2026-109618 and CVE-2026-109619). There is no press release, knowledge base article, or blog post from A2 Hosting in the available search results regarding this vulnerability. I cannot confirm whether A2 Hosting has patched or officially responded to PHP2Shell", "cited_urls": [ "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://sansec.io/research/php2shell", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": true, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is A2 Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "A2 Hosting is potentially affected, because PHP2Shell affects unpatched PHP installations serving web requests, regardless of hosting provider. However, there is no publicly verifiable A2 Hosting statement in the available sources confirming whether its servers were affected or whether patching has been completed. The PHP fixes were released on October 21, 2026, in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.", "cited_urls": [ "https://github.com/hkoeck/php2shell-status", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://sansec.io/research/php2shell", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is A2 Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, A2 Hosting uses standard cPanel/EasyApache and shared infrastructure affected by the core PHP vulnerabilities known as PHP2Shell ( CVE-2026-109618 and CVE-2026-109619), and platform vendors and upstream package maintainers (such as cPanel and CloudLinux) have been rolling out backported patches across shared hosting and managed environments. hosting.com +2 Overview of Impact and Patch Status Vulnerability Nature : CVE-2026-109618 (out-of-memory", "cited_urls": [ "https://status.hosting.com/incident/3174", "https://cyberunit.com/insights/cpanel-vulnerability-cve-2026-41940-business-impact/", "https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is A2 Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: Yes, potentially. Any hosting environment running unpatched versions of PHP handling web requests (such as Apache, LiteSpeed, or PHP-FPM) is inherently exposed to the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) until the underlying PHP runtime is upgraded. Because web hosting providers like A2 Hosting host applications running various PHP versions across user accounts, servers are", "cited_urls": [ "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623", "https://security.paloaltonetworks.com/CVE-2026-109618" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "abbadox", "company": "AbbaDox", "canonical_domain": "abbadox.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:AbbaDox PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.abbadox.com/", "https://www.abbadox.com/trust (Security & Compliance, \"Last updated July 2026\")", "https://www.abbadox.com/news (newest May 2026)", "https://www.abbadox.com/blog (newest August 2026)" ], "last_checked_utc": "2026-10-23T01:40:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Security page says \"We scan, patch, and test on an ongoing cadence, so known risks don't sit and wait.\" (quoted from https://www.abbadox.com/trust); generic, no advisory. Trust Center at trust.abbadox.com linked, not opened.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "abeldent", "company": "ABELDent", "canonical_domain": "abeldent.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.abeldent.com/ (response unreadable, compressed content)", "https://www.abeldent.com/news/ (fetch failed, client error)", "https://www.abeldent.com/blog/", "https://www.abeldent.com/support/ (response unreadable, compressed content)", "https://www.abeldent.com/contact/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Blog newest post October 19, 2026 (online forms); contact page references a SOC 2 Type 2 audit letter and Cloud Protection link; no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "abrigo", "company": "Abrigo", "canonical_domain": "abrigo.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Abrigo PHP2Shell", "https://www.abrigo.com/", "https://www.abrigo.com/software/data-platform-security/", "https://www.abrigo.com/company/news/ (items undated)", "https://www.abrigo.com/knowledge-center/blog/ (newest October 21, 2026)", "https://www.abrigo.com/blog/building-a-more-effective-fincrime-program-in-the-age-of-ai/ (dated October 21, 2026, no PHP content)" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Data and Platform Security page describes the program and a responsible disclosure route only. No status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ace-dental", "company": "ACE Dental", "canonical_domain": "ace-dental.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.ace-dental.com/", "https://www.ace-dental.com/about", "https://www.ace-dental.com/support (fetch failed, client error)", "https://www.ace-dental.com/features (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust, status, blog or news link in site navigation; about page has no security notice.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "acquia", "company": "Acquia", "canonical_domain": "acquia.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://status.acquia.com/incidents/h97qtbwysj8m", "statement_date": "Resolved Oct 22, 20:30 UTC (Identified Oct 21, 18:15 UTC)", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "status page", "places_checked": [ "https://status.acquia.com/", "https://status.acquia.com/incidents/h97qtbwysj8m (read via the status homepage)", "https://www.acquia.com/blog (newest post 13 Sep 2026)", "search:Acquia PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:28:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "All Acquia customer applications have been patched and remain online.", "notes": "\"All Acquia customer applications have been patched and remain online.\" (Oct 22, 07:48 UTC) and \"All Acquia services have been restored and are fully operational.\" (Resolved, Oct 22, 20:30 UTC) quoted from https://status.acquia.com/ (incident: Acquia Cloud Platform management services temporarily unavailable; maintenance reference #7614). Management services, Campaign Studio, Campaign Factory and Site Studio were disabled as a precaution for \"a critical PHP security release\" and restored through Oct 22; \"No action is required.\" (Oct 22, 04:28 UTC). No fixed version, restart or EOL statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "actionstep", "company": "Actionstep", "canonical_domain": "actionstep.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Actionstep PHP2Shell", "https://www.actionstep.com/security/ (fetch failed, client error)", "https://www.actionstep.com/ (homepage, status links pm.actionstep-status.com and la.actionstep-status.com, no notice)", "https://status.actionstep.com/ (302 redirect to https://pm.actionstep-status.com/, Practice Management status page)" ], "last_checked_utc": "2026-10-23T02:07:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Practice Management status page shows \"No incidents reported.\" for 20, 21 and 22 Oct 2026 and \"No incidents reported today.\" for 23 Oct 2026, header \"All Systems Operational\", quoted from https://pm.actionstep-status.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "aderant", "company": "Aderant", "canonical_domain": "aderant.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Aderant PHP2Shell", "search:Aderant news October 2026", "https://www.aderant.com/", "https://www.aderant.com/security/ (page titled Security, body carries no security content)", "https://www.aderant.com/news-pr/ (listing rendered without items)", "https://www.aderant.com/blog/ (listing rendered without items)", "https://www.aderant.com/articles/" ], "last_checked_utc": "2026-10-23T00:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No dedicated trust center or status page linked from the homepage. News and blog listing pages rendered without items on fetch, so the newest post could not be read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "adit", "company": "Adit", "canonical_domain": "adit.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://adit.com/", "https://adit.com/blog", "https://adit.com/press-release" ], "last_checked_utc": "2026-10-23T01:17:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust or status link in site navigation; blog newest post 19 October 2026; press releases undated; no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "adobe-commerce-magento", "company": "Adobe Commerce, Magento", "canonical_domain": "business.adobe.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.adobe.com/trust/security/bulletins-and-advisories.html (last updated 13 Oct 2026", "newest Commerce bulletin APSB26-153, nothing on PHP2Shell)", "https://helpx.adobe.com/security.html (archive, newest 22 Sep 2026)", "https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-announcements/announcements (fetch failed twice, client error)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Adobe Commerce and Magento Open Source listed Vulnerable citing PHP requirement docs only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Adobe statement on PHP2Shell found at the Adobe Trust Center bulletins page or the legacy helpx security archive as of the last check; the Commerce knowledge-base announcements page could not be read. NCSC-NL inventory lists Adobe Commerce and Magento Open Source as Vulnerable on the basis of Adobe's PHP system requirements, not an Adobe statement.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Adobe Commerce (Magento) affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Adobe Commerce (Magento) is affected when it runs on a vulnerable PHP runtime. PHP fixes are available, but that does not establish that Adobe has patched every Commerce deployment. As of October 23, 2026: | Question | Verified status | |---|---| | Is Adobe Commerce affected? | NCSC-NL’s current PHP2Shell tracker lists Adobe Commerce as “Vulnerable” to both CVE-2026-109618", "cited_urls": [ "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_a.md", "https://www.php.net/", "https://www.php2shell.com/?utm_source=openai" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Adobe Commerce (Magento) affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive answer based on multiple sources: Is Adobe Commerce (Magento) Affected by PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? ✅ Yes — Adobe Commerce (Magento) Is Affected Because the flaws sit in PHP itself, every Magento 2, Adobe Commerce, WooCommerce, and WordPress store is exposed until the PHP on its server is updated. PHP2Shell refers to two critical PHP", "cited_urls": [ "https://www.czargroup.net/blog/php2shell-cve-2026-109618-cve-2026-109619-for-magento-2-adobe-commerce-and-woocommerce/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "http://www.iovista.com/blog/php2shell-vulnerabilities-cve-2026-109618-109619/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Adobe Commerce (Magento) affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Adobe Commerce/Magento is affected when it runs on a vulnerable PHP runtime, because PHP2Shell is a PHP-engine vulnerability rather than a Magento application flaw. The affected scope includes PHP 5.4 and later; the application’s own code can be clean and still be exposed. It has not been patched in Adobe Commerce itself. The remediation is to update the", "cited_urls": [ "https://magentoinfo.com/blog/php-critical-rce-flaws-magento-adobe-commerce", "https://everyhost.co.uk/insights/php2shell-magento-cve-2026-109618", "https://www.iovista.com/blog/php2shell-vulnerabilities-cve-2026-109618-109619/", "https://ceymox.com/latest-news/adobe-commerce-php2shell-security-update/", "https://avada.io/blog/php2shell-php-vulnerability/", "https://meetanshi.com/blog/magento-2-php-vulnerabilities-security-alert/", "https://no7software.co.uk/blog/php2shell-php-vulnerability", "https://github.com/0xDTC/0xPHP2SHELL-Impact-Analysis/blob/master/Readme.md", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_m.md", "https://sansec.io/research/php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Adobe Commerce (Magento) affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Adobe Commerce and Magento Open Source are affected because PHP2Shell is a vulnerability in the underlying PHP language runtime rather than a flaw in the application code itself. Impact and Patch Status Affected Status: Any Adobe Commerce or Magento store running on an unpatched PHP version is exposed, even if the Adobe Commerce application itself is fully up", "cited_urls": [ "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://zynovo.com/blog/critical-security-alert-php2shell-vulnerabilities-affecting-magento-and-adobe-commerce/", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Adobe Commerce (Magento) affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Is Adobe Commerce (Magento) Affected? Yes. Adobe Commerce and Magento Open Source are affected because they run on PHP, and the PHP2Shell vulnerabilities reside in the underlying PHP runtime environment itself rather than within Magento's application code. The Vulnerabilities: Tracked as CVE-2026-109618 and CVE-2026-109619, these critical flaws (rated 9.2 on CVSS v4.0) impact all vulnerable PHP installations serving web", "cited_urls": [ "https://sansec.io/research/php2shell", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://projectdiscovery.io/research/php2shell", "https://ceymox.com/latest-news/adobe-commerce-php2shell-security-update/", "https://massmarketretailers.com/critical-php-flaw-puts-retail-websites-and-e-commerce-systems-on-alert/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "advapacs", "company": "AdvaPACS", "canonical_domain": "advapacs.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:AdvaPACS PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.advapacs.com/ (302 redirect to https://adva.health/advapacs/, read)", "https://adva.health/security-and-compliance/", "https://status.advapacs.com/ (9 to 23 October 2026 read)", "https://adva.health/news-insights/ (newest 23 Sep 2026)" ], "last_checked_utc": "2026-10-23T01:40:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "advapacs.com redirects to adva.health. Status page shows \"All Systems Operational\" and \"No incidents reported\" for 20, 21, 22 and 23 October 2026 (quoted from https://status.advapacs.com/). Security page links a vulnerability disclosure form; no advisory.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "agency-systems-newton", "company": "Agency Systems (Newton)", "canonical_domain": "agencysystems.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Agency Systems Newton PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.agencysystems.com/ (homepage", "no trust or status link)", "https://agencysystems.com/capabilities/secure-architecture/ (Secure Architecture page, modified 2026-10-15, no PHP or CVE mention)", "https://agencysystems.com/blog/ (newest post May 2025)", "https://status.agencysystems.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "agencybloc", "company": "AgencyBloc", "canonical_domain": "agencybloc.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:AgencyBloc PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.agencybloc.com/ (homepage)", "https://www.agencybloc.com/about-us/security/ (security overview, no PHP or CVE mention)", "https://www.agencybloc.com/agency-management-system/data-and-security/ (data and security page, no PHP mention)", "https://www.agencybloc.com/news/ (items undated, none on PHP)", "https://status.agencybloc.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "agencyzoom", "company": "AgencyZoom", "canonical_domain": "agencyzoom.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:AgencyZoom PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.agencyzoom.com/ (homepage", "no security, status or blog link", "footer privacy and terms links point to vertafore.com)", "https://support.agencyzoom.com/en/collections/3344009-what-s-new (feature releases", "newest \"Release Updates - October 2026\", no day given, no PHP mention)", "https://www.agencyzoom.com/blog (fetch failed, client error)", "https://www.agencyzoom.com/security (fetch failed, client error)", "https://status.agencyzoom.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Footer legal links go to Vertafore; see the Vertafore row for its trust center.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "agfa-healthcare", "company": "Agfa HealthCare", "canonical_domain": "agfahealthcare.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": true, "statement_url": "https://www.agfahealthcare.com/news/update-on-php-security-incident/", "statement_date": "October 22, 2026", "status": "mitigation only", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "search:Agfa HealthCare PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.agfahealthcare.com/", "https://www.agfahealthcare.com/news/update-on-php-security-incident/", "https://www.agfahealthcare.com/security/", "https://www.agfahealthcare.com/news/ (listing newest 29 Sep 2026", "the 22 Oct item is linked from the homepage)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Article \"Update on PHP Security Incident\" (October 22, 2026) describes \"a critical security issue that may allow attackers to execute commands on any web server running this scripting language.\" quoted from https://www.agfahealthcare.com/news/update-on-php-security-incident/. It says \"AGFA HealthCare is doing an in-depth analysis of our products to confirm that there are no vulnerabilities present.\" and, for its PHP-based non-product web pages, \"we have taken these pages offline, as a precaution, until they can be patched.\" Also: \"In this regard, no action is required by any customer.\" Mixed case: products under analysis (no affected or not-affected finding yet), websites offline pending patch, further updates promised. Does not name PHP2Shell, the CVEs or a PHP version.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "airtable", "company": "Airtable", "canonical_domain": "airtable.com", "group": "index_vendor", "index_category": "project_management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Airtable PHP2Shell", "https://www.airtable.com/security (trust and security page, no advisories section, no PHP mention)", "https://status.airtable.com/ (status page)", "https://www.airtable.com/articles (blog, posts undated, none on PHP)" ], "last_checked_utc": "2026-10-23T02:17:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for 20 and 21 October and \"No incidents reported today.\" for 22 October 2026, \"All Systems Operational\", quoted from https://status.airtable.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "akamai-linode", "company": "Akamai Linode", "canonical_domain": "linode.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://status.linode.com/incidents/wq8zlhk736fk", "statement_date": "Oct 22, 2026 - 18:19 UTC (latest update; Investigating Oct 21, 2026 - 14:44 UTC)", "status": "customer must update", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "status page", "places_checked": [ "https://status.linode.com/", "https://status.linode.com/incidents/wq8zlhk736fk", "https://www.linode.com/blog/ (redirects to https://www.akamai.com/blog/developers, not read)", "https://www.akamai.com/blog (no PHP post)", "search:Linode PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "we recommend following guidance from the upstream vendor (PHP) and applying upstream patches as they become available.", "notes": "\"we recommend following guidance from the upstream vendor (PHP) and applying upstream patches as they become available.\" (for anyone running a vulnerable PHP on a Linode instance) and \"our Cloud Infrastructure Speed Tests will be unavailable.\" (as part of ongoing mitigation) quoted from https://status.linode.com/incidents/wq8zlhk736fk (title: Customer Security Advisory: PHP Remote Code Execution Vulnerabilities). Akamai says it is investigating potential impact across its platform; it does not say its services are affected or patched; incident not resolved at this check.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "alvys", "company": "Alvys", "canonical_domain": "alvys.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://alvys.com/", "https://trust.alvys.com/ (fetch failed, robots disallowed)", "https://alvys.com/resources/news", "https://alvys.com/resources/blog" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. Trust center could not be fetched. Newest news item 23 September 2026, newest blog post 14 October 2026; no status page found. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "amadeus-hospitality-ihotelier", "company": "Amadeus Hospitality (iHotelier)", "canonical_domain": "amadeus-hospitality.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Amadeus Hospitality iHotelier PHP2Shell", "https://www.amadeus-hospitality.com/ (homepage", "no security or status link)", "https://www.amadeus-hospitality.com/category/news/ (items undated on listing, none on PHP)", "https://www.amadeus-hospitality.com/insight/ (posts undated on listing, none on PHP)", "https://amadeus.com/en/policies/compliance-reports-repository (compliance documents page, no PHP mention)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No dedicated security, trust or status page linked from the site; footer links to the Amadeus compliance reports repository.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "amicus-attorney", "company": "Amicus Attorney", "canonical_domain": "amicusattorney.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Amicus Attorney PHP2Shell", "https://www.amicusattorney.com/", "https://amicusattorney.com/press/ (newest item Apr 19, 2021)", "https://amicusattorney.com/blog/ (redirects to https://caretlegal.com/blog/, newest post July 7, 2026)", "https://caretlegal.com/security/", "https://status.caretlegal.com/ (content requires JavaScript, nothing retrieved)" ], "last_checked_utc": "2026-10-23T00:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Amicus Attorney is a CARET (caretlegal.com) product; its blog redirects to CARET Legal. CARET security page and blog carry no PHP2Shell content. CARET status page could not be read (JavaScript-only rendering).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "apaleo", "company": "Apaleo", "canonical_domain": "apaleo.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Apaleo PHP2Shell", "https://apaleo.com/ (homepage", "no security or trust link)", "https://status.apaleo.com/ (status page)", "https://apaleo.com/blog (newest post 9/30/2026)", "https://apaleo.com/security (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for Oct 20 and Oct 21, 2026 and \"No incidents reported today.\" for Oct 22, 2026, quoted from https://status.apaleo.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "appfolio", "company": "AppFolio", "canonical_domain": "appfolio.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:AppFolio PHP2Shell", "https://www.appfolio.com/security (security page, no PHP or CVE mention, links Customer Trust, blog and newsroom, no status link)", "https://www.appfolio.com/trust/ (Customer Trust page, no PHP mention)", "https://status.appfolio.com/ (status page)", "https://www.appfolio.com/newsroom (newest release October 6, 2026, none on PHP)" ], "last_checked_utc": "2026-10-23T02:09:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page reads \"No notices reported for the past 7 days\" and \"All systems operational\", quoted from https://status.appfolio.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "applied-systems", "company": "Applied Systems", "canonical_domain": "appliedsystems.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Applied Systems PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.appliedsystems.com/ (302 redirect to https://www1.appliedsystems.com/en-us)", "https://www1.appliedsystems.com/en-us (homepage)", "https://www1.appliedsystems.com/en-us/security/ (security page", "CSA STAR registry, SOC 3 report and HackerOne disclosure form linked", "no PHP or CVE mention", "no advisories or status page linked)", "https://www1.appliedsystems.com/en-us/news/press-releases/2026/ (newest item September 30, 2026)", "https://www1.appliedsystems.com/en-us/blog/ (posts undated, none on PHP)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No trust center, advisory list or status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "asana", "company": "Asana", "canonical_domain": "asana.com", "group": "index_vendor", "index_category": "project_management", "statement_found": true, "statement_url": "https://trustcenter.asana.com/", "statement_date": "Oct 22, 2026, 19:49 UTC", "status": "not affected", "fixed_version_named": "yes: 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "search:Asana PHP2Shell", "https://trustcenter.asana.com/ (statement, Trust Center announcement)", "https://status.asana.com/ (status page, Oct 21, 2026 \"Asana downtime\" incident with no PHP mention)" ], "last_checked_utc": "2026-10-23T02:16:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Announcement \"Asana response to PHP2Shell (CVE-2026-109618 and CVE-2026-109619)\": \"Asana and StackAI's production application and the supporting infrastructure that processes customer data do not use PHP.\" and \"Because Asana is not impacted, no remediation, patching, or mitigation actions are required on our end.\" quoted from https://trustcenter.asana.com/ (no permalink). Recommends organizations running their own PHP upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or apply a vendor backport.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ascendtms", "company": "AscendTMS", "canonical_domain": "ascendtms.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.ascendtms.com/ (rendered only a loading placeholder)", "https://ascendtms.com/ (loading placeholder)", "https://www.ascendtms.com/blog (loading placeholder)", "https://www.inmotionglobal.com/ (redirects to https://www.thefreetms.com/)", "https://www.thefreetms.com/", "https://www.thefreetms.com/press-releases", "https://www.thefreetms.com/release-history" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. ascendtms.com pages rendered only a loading placeholder; the marketing site thefreetms.com (copyright InMotion Global, Inc.) has no security, trust or status page. Newest press item 15 September 2026; newest release 1.609.17717 dated 17 September 2026. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "assembly-neos", "company": "Assembly Neos", "canonical_domain": "assemblysoftware.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Assembly Neos PHP2Shell", "https://www.assemblysoftware.com/", "https://status.neos-cloud.com/ (no notices reported for the past 7 days)", "https://www.assemblysoftware.com/media/newsroom", "https://www.assemblysoftware.com/post/questions-before-you-bring-ai-into-your-case-files (blog post dated Oct 21, 2026, no PHP content)", "https://www.assemblysoftware.com/media/release-notes (newest May 20, 2026)" ], "last_checked_utc": "2026-10-23T00:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page at status.neos-cloud.com showed both services Operational and \"No notices reported for the past 7 days\" (quoted from https://status.neos-cloud.com/). No security or trust page linked from the homepage.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "auto-mate", "company": "Auto/Mate", "canonical_domain": "automate.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.automate.com/", "https://automate.com/blog/", "https://automate.com/about/press-release/" ], "last_checked_utc": "2026-10-23T00:37:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust or status link in site navigation; blog newest post Jun 25, 2021; press releases newest Nov 18, 2021.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "autodesk-construction-cloud", "company": "Autodesk Construction Cloud", "canonical_domain": "autodesk.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": true, "statement_url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-php-security-vuln", "statement_date": "10/21/2026", "status": "patching", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (named as the PHP Foundation's patched versions)", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "search:Autodesk Construction Cloud PHP2Shell", "https://www.autodesk.com/trust/security-advisories", "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-php-security-vuln", "https://health.autodesk.com/", "https://adsknews.autodesk.com/en/news/" ], "last_checked_utc": "2026-10-23T00:16:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Autodesk is aware of the recently identified critical PHP vulnerabilities that, according to the PHP security advisory, can allow unauthenticated remote code execution.", "notes": "\"Autodesk is aware of the recently identified critical PHP vulnerabilities that, according to the PHP security advisory, can allow unauthenticated remote code execution.\" and \"Impact: Autodesk is actively investigating any possible impact and deploying fixes.\" quoted from https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-php-security-vuln. Bulletin titled \"Important information about critical vulnerabilities in PHP\", Original Publish 10/21/2026. Names CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2 each); does not use the name PHP2Shell; does not say which Autodesk products or services are affected; company-wide bulletin, not specific to Autodesk Construction Cloud. health.autodesk.com shows no PHP item.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "automanager", "company": "AutoManager", "canonical_domain": "automanager.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.automanager.com/", "https://www.automanager.com/blog/", "https://www.automanager.com/news/ (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T01:05:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust or status link in site navigation; blog newest post Jan 28, 2026.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "autosoft", "company": "Autosoft", "canonical_domain": "autosoftdms.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.autosoftdms.com/", "https://autosoftdms.com/platform/dms-security-control/", "https://autosoftdms.com/company/news-press/", "https://autosoftdms.com/resource-center/blog/" ], "last_checked_utc": "2026-10-23T01:06:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Security + Control page is a product feature page with no PHP mention; news and blog newest items 09/29/26; no status page link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "avail", "company": "Avail", "canonical_domain": "avail.co", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Avail landlord avail.co PHP2Shell", "https://www.avail.co/ (fetch failed, site blocked)", "https://www.avail.com/ (homepage, part of Realtor.com, no security, trust or status link, no notice)", "https://www.avail.com/blog (blog, posts undated, none on PHP)" ], "last_checked_utc": "2026-10-23T02:13:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "avail.co could not be fetched; the brand's live site is avail.com. No PHP2Shell item found.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "aven-hospitality-synxis", "company": "Aven Hospitality (SynXis)", "canonical_domain": "avenhospitality.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Aven Hospitality SynXis PHP2Shell", "search:Aven Hospitality CVE-2026-109618 (not performed, search budget exhausted)", "https://www.avenhospitality.com/ (homepage", "script-rendered, only metadata readable, no PHP mention)", "https://www.avenhospitality.com/news (news listing rendered empty to the reader)", "https://www.avenhospitality.com/security (fetch failed, client error)", "https://status.avenhospitality.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Site is script-rendered; no page text beyond metadata could be read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "avimark", "company": "AVImark", "canonical_domain": "covetrus.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.covetrus.com/", "https://covetrus.com/about/newsroom/", "https://covetrus.com/insights-center/", "https://covetrus.com/legal/", "https://status.covetrus.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. AVImark is a Covetrus product; the covetrus.com check (no security, trust or advisory page; newsroom and insights undated) covers it. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "aws", "company": "AWS", "canonical_domain": "aws.amazon.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://aws.amazon.com/security/security-bulletins/2026-143-aws/", "statement_date": "Publication Date: 10/21/2026 14:30 PM PDT; Last Updated Date: 10/22/2026 14:00 PM PDT", "status": "patched partly", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://aws.amazon.com/security/security-bulletins/2026-143-aws/", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:38:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Bulletin 2026-143-AWS, title: PHP web runtimes (CVE-2026-109618 and CVE-2026-109619). Amazon WorkMail upgraded to PHP 8.3.36: \"No customer action is required.\"; Elastic Beanstalk released updated PHP platform versions for 8.2 to 8.5 (automatic only with Managed Platform Updates); \"Updated PHP packages for commercial regions are available; non-commercial are targeted for 2026-10-22.\"; \"AWS cannot update running Lightsail instances in place.\"; \"AWS Lambda does not provide a managed PHP runtime.\"; EOL: \"No fix is available for CVE-2026-109618 on end-of-life branches.\" and \"Migration to a supported branch is required.\"; interim controls for EOL runtimes say to \"restart PHP workers\". AWS WAF PHP Managed Rule Group as compensating control. quoted from https://aws.amazon.com/security/security-bulletins/2026-143-aws/", "ai_answer_note": null, "ai_answers": [] }, { "slug": "axon-software", "company": "Axon Software", "canonical_domain": "axonsoftware.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.axonsoftware.com/", "https://axonsoftware.com/trucking-news/", "https://axonsoftware.com/blog/" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or status page on axonsoftware.com. Newest news and blog items dated 9 January 2025. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "baker-hill", "company": "Baker Hill", "canonical_domain": "bakerhill.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Baker Hill PHP2Shell", "https://www.bakerhill.com/", "https://bakerhill.com/compliance", "https://bakerhill.com/news (newest 2026-10-16)", "https://bakerhill.com/blog (newest 2026-09-18)" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No trust center or status page linked from the site; release notes sit behind the client community login.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "basecamp", "company": "Basecamp", "canonical_domain": "basecamp.com", "group": "index_vendor", "index_category": "project_management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Basecamp PHP2Shell", "https://basecamp.com/about/policies/security (302 redirect to https://37signals.com/policies/security, no PHP or CVE mention)", "https://www.basecampstatus.com/ (fetch failed, robots disallowed)", "https://updates.37signals.com/ (37signals product updates, newest 1/9/26, none on PHP)" ], "last_checked_utc": "2026-10-23T02:18:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Basecamp's security policy is published by 37signals. No PHP2Shell item found.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "baselane", "company": "Baselane", "canonical_domain": "baselane.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Baselane PHP2Shell", "search:Baselane PHP2Shell CVE-2026-109618", "https://www.baselane.com/security/", "https://www.baselane.com/product-updates", "https://www.baselane.com/resources", "https://support.baselane.com/hc/en-us" ], "last_checked_utc": "2026-10-23T00:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Security page is a general security overview with no advisories; no status page. Blog posts dated 22 October 2026 are banking comparison articles; none concern security. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "bigchange", "company": "BigChange", "canonical_domain": "bigchange.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": true, "statement_url": "https://status.bigchange.com/cmvjrb4hy068o1brq85pt86w2", "statement_date": "22 October 2026 at 4:29:48 PM UTC", "status": "not affected", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "status page", "places_checked": [ "search:BigChange PHP2Shell", "https://www.bigchange.com/ (homepage", "footer has no security or status link)", "https://www.bigchange.com/blog (posts undated, none on PHP)", "https://www.bigchange.com/security (fetch failed, client error)", "https://status.bigchange.com/ (status page, notice found)", "https://status.bigchange.com/cmvjrb4hy068o1brq85pt86w2 (notice permalink, read in full)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Notice title \"BigChange systems are not impacted by PHP vulnerabilities\"; body \"BigChange does not use PHP and is not impacted by any of the recent PHP vulnerabilities\" quoted from https://status.bigchange.com/cmvjrb4hy068o1brq85pt86w2, posted 22 October 2026 at 4:29:48 PM UTC. Does not name PHP2Shell or the CVE numbers; no version, restart or EOL detail.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "bigrock", "company": "BigRock", "canonical_domain": "bigrock.in", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://forums.bigrock.in/issue/2542", "statement_date": "Last Updated October 22nd, 2026 3:43 pm IST", "status": "mitigation only", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "status page", "places_checked": [ "https://www.bigrock.in/ (no banner", "System Status link goes to https://forums.bigrock.in)", "https://www.bigrock.in/blog/ (no PHP post)", "https://forums.bigrock.in/ (lists the item)", "https://forums.bigrock.in/issue/2542 (fetch failed, client_error, twice", "retry next hour)", "search:BigRock PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:33:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "BigRock's live service status page (forums.bigrock.in, Pulse) lists an item titled \"Important Security Update: PHP Security Mitigations\", status \"Identified\", \"Last Updated October 22nd, 2026 3:43 pm IST\" (quoted from https://forums.bigrock.in/). The item body at https://forums.bigrock.in/issue/2542 could not be fetched, so the status here rests on the listed title and Identified state only; products, versions and customer actions are unknown. Re-check the body.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "bill4time", "company": "Bill4Time", "canonical_domain": "bill4time.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Bill4Time PHP2Shell", "https://www.bill4time.com/ (homepage, footer Security Statement link, no status or newsroom link, no notice)", "https://www.bill4time.com/security-statement/ (security statement, metadata modified 2025-08-20, no PHP or CVE mention)", "https://www.bill4time.com/blog/ (blog, posts undated, none on PHP)" ], "last_checked_utc": "2026-10-23T02:07:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page linked. No PHP2Shell item on the security statement or blog.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "bindhq", "company": "BindHQ", "canonical_domain": "bindhq.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:BindHQ PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.bindhq.com/ (homepage", "no security or status link)", "https://www.bindhq.com/blog (newest post Aug 6, 2025)", "https://www.bindhq.com/security (fetch failed, client error)", "https://status.bindhq.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page linked from the site; blog last updated August 2025.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "bit-dealership-software", "company": "BiT Dealership Software", "canonical_domain": "bitdms.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.bitdms.com/", "https://www.bitdms.com/status", "https://www.bitdms.com/bit-dealership-software-press/" ], "last_checked_utc": "2026-10-23T01:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Cloud App Status page reads \"The system is operating normally.\" with no incidents listed (metadata modified 2026-07-08); press newest item August 3, 2026; no security page link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "blend", "company": "Blend", "canonical_domain": "blend.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Blend blend.com PHP2Shell", "https://blend.com/", "https://blend.com/security-and-compliance/", "https://blend.com/company/newsroom/ (items undated)", "https://status.blend.com/ (20 to 22 October 2026 read)" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"All Systems Operational\" and \"No incidents reported\" for 20, 21 and 22 October 2026 (quoted from https://status.blend.com/). No trust center or advisory page located.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "blue-yonder", "company": "Blue Yonder", "canonical_domain": "blueyonder.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Blue Yonder PHP2Shell CVE-2026-109618", "https://blueyonder.com/trust (fetch failed)", "https://trust.blueyonder.com/ (fetch failed, robots disallowed)", "https://blueyonder.com/", "https://blueyonder.com/security", "https://blueyonder.com/media", "https://blueyonder.com/blog" ], "last_checked_utc": "2026-10-23T00:21:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Security page describes the general security program (NIST and ISO frameworks, incident response) with no advisories. Newsroom and blog show undated items, none on security. No status page found. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "bluehost", "company": "Bluehost", "canonical_domain": "bluehost.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.bluehost.com/status/announcement/271", "statement_date": "Posted 21st October, 2026; latest update Oct 22nd 10:00est", "status": "patching", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (per-platform build list for cPanel EasyApache 4, CloudLinux alt-php, Plesk, AlmaLinux, Rocky, CentOS Stream, Fedora, Ubuntu, Debian)", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://www.bluehost.com/status/announcement/271", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "successfully patched the majority of servers", "notes": "\"successfully patched the majority of servers\" (Oct 21st 23:00est) and \"significant progress deploying patched PHP builds across our hosting infrastructure\" (Oct 22nd 10:00est) quoted from https://www.bluehost.com/status/announcement/271 (title: PHP Updates). No completion notice at this check. Customers on patched versions need no action; self-managed VPS/dedicated customers told to run a package update through their control panel; some customers may receive emails with steps; upload file size limits possible while mitigations are in place. Lists patched builds for older branches (5.2 to 7.4) under CloudLinux alt-php and cPanel vendor backports without calling them end-of-life.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Bluehost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Bluehost is treating these CVEs as affecting its hosting infrastructure and has patched the majority of its systems—but has not confirmed a complete rollout. As checked on October 23, 2026, its latest posted update is October 22 at 18:15 (labeled “EST” by Bluehost). It says patched PHP builds are still being deployed to the remaining infrastructure. Bluehost’s official “PHP", "cited_urls": [ "https://www.bluehost.com/status/announcement/271" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Bluehost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on thorough searching across multiple security sources, there is no public statement, advisory, or announcement from Bluehost specifically addressing PHP2Shell (CVE-2026-109618 and CVE-2026-109619). No security researcher, vendor bulletin, or news outlet has published information confirming whether Bluehost has patched or even formally acknowledged these vulnerabilities at this time. Here is what is known about the vulnerabilities themselves, and", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": true, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Bluehost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Bluehost is potentially affected wherever it hosts websites running vulnerable PHP versions. PHP2Shell affects the PHP runtime itself, not a particular CMS or hosting brand; vulnerable versions include PHP 8.2.0–8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, and 8.5.0–8.5.11. The PHP fixes were released on October 21, 2026, in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. However, no reliable public Bluehost statement confirming that all", "cited_urls": [ "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/NCSC-NL/php2shell", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "https://github.com/NCSC-NL/php2shell/blob/main/README.md" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Bluehost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Bluehost was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the hosting provider has rolled out patches across the majority of its infrastructure. Status and Patching Details Impact: Bluehost platforms running unpatched PHP versions inherit the risk of the critical remote code execution (RCE) flaws (CVSS 9.2). Patch Status: Bluehost has made significant progress deploying patched PHP builds", "cited_urls": [ "https://www.bluehost.com/status/announcement/271", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell", "https://www.clarin.com/us-news/php-vulnerability-2026-explained-what-happened-with-php2shell-how-it-affects-millions-of-sites-and-what-precautions-you-must-take_0_mIsl8QvvI4.html" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Bluehost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Bluehost's hosting infrastructure is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which impact underlying PHP core runtimes globally. Patch Status In Progress / Partially Patched: Bluehost's teams have been actively rolling out patched PHP builds across their hosting infrastructure. As of their latest updates, the majority of their shared and managed platforms have been updated, though deployment", "cited_urls": [ "https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619", "https://www.bluehost.com/status/announcement/271", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null } ] }, { "slug": "bluehost-india", "company": "Bluehost India", "canonical_domain": "bluehost.in", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.bluehost.com/status/announcement/271", "statement_date": "Posted 21st October, 2026; latest update Oct 22nd 10:00est", "status": "patching", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (per-platform build list)", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://www.bluehost.in/ (redirects to https://www.bluehost.com/in)", "https://www.bluehost.com/in (India storefront, no banner", "links to https://www.bluehost.com/status and https://www.bluehost.com/blog/)", "https://www.bluehost.com/status/announcement/271", "search:Bluehost India PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:31:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No India-specific statement; bluehost.in redirects to the India storefront at bluehost.com/in, whose Server Status link is the global status page, so Bluehost's announcement applies: \"successfully patched the majority of servers\" (Oct 21st 23:00est) and \"significant progress deploying patched PHP builds across our hosting infrastructure\" (Oct 22nd 10:00est) quoted from https://www.bluehost.com/status/announcement/271 (title: PHP Updates). No completion notice at this check; self-managed VPS/dedicated customers told to run a package update.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "bookstack", "company": "BookStack", "canonical_domain": "bookstackapp.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.bookstackapp.com/blog/php-security-release-critical/ (fetch failed twice, server error, 01:05Z and 01:20Z)", "https://www.bookstackapp.com/blog/ (stale listing, newest items early 2025)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (BookStack listed Fix citing the blog post php-security-release-critical and install docs)", "fetch limit, retry next hour" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "The BookStack blog post that NCSC-NL cites could not be read in this run (server error), so no statement is confirmed here. Reported by NCSC-NL inventory (status update 23 Oct 2026): BookStack fixed by running on PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or vendor-confirmed Ubuntu backports. Unverified until the post is read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "bref", "company": "Bref", "canonical_domain": "bref.sh", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://bref.sh/news/06-php-security-release-october-2026", "statement_date": "October 21, 2026", "status": "patched", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; bref/bref 3.0.14 (layers php-85:21, php-84:24, php-83:24, php-82:26) and 2.4.22 (layer version 2.3.45); rebuilt bref/php-82 to php-85 Docker images", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://bref.sh/news/06-php-security-release-october-2026", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Bref PHP Lambda runtime layers, adapter and v2 Docker images listed Fix citing this post and issue 2222)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"Bref: PHP security release of October 2026\" names CVE-2026-109618 and CVE-2026-109619. Patched Bref 3 and Bref 2 Lambda layers and Docker images published; Bref 1 not rebuilt (unmaintained, upgrade). Users run composer update bref/bref -W and redeploy, or docker build, pull and redeploy: \"Then redeploy. That's it for most applications\" and \"The fix is in the Zend engine itself, and every layer was rebuilt.\" quoted from the statement URL. Bref Cloud Laravel apps receive the new layers on their next deploy. PHP 8.1 and older are end of life and receive no fix; upgrade to 8.2 or later. Bref is the runtime behind Craft Cloud (see Craft CMS row).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "broadcastwell", "company": "Broadcastwell", "canonical_domain": "broadcastwell.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://broadcastwell.com/security#php2shell", "statement_date": "23 October 2026", "status": "not affected", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://broadcastwell.com/security#php2shell", "https://broadcastwell.com/company-facts" ], "last_checked_utc": "2026-10-23T01:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "None serves web requests through PHP, so none is affected and no fix was required on our side.", "notes": "\"None serves web requests through PHP, so none is affected and no fix was required on our side.\" quoted from https://broadcastwell.com/security#php2shell (our own statement, which lists every Broadcastwell service reviewed).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "buildertrend", "company": "Buildertrend", "canonical_domain": "buildertrend.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Buildertrend PHP2Shell", "search:Buildertrend security trust center page", "https://buildertrend.com/security/ (fetch failed, client error)", "https://trustcenter.buildertrend.com/", "https://buildertrend.com/blog/", "https://status.buildertrend.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:17:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trust center has no PHP mention and no dated updates; blog listing shows no dates and no security post.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "buildium", "company": "Buildium", "canonical_domain": "buildium.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Buildium PHP2Shell", "https://www.buildium.com/security/ (fetch failed, client error)", "https://www.buildium.com/ (homepage, Data Security feature link, no trust or status link, no notice)", "https://status.buildium.com/ (status page, past incidents list in the fetch ended at 19 October, \"All Systems Operational\")", "https://www.buildium.com/blog/ (blog, posts undated, none on PHP)" ], "last_checked_utc": "2026-10-23T02:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No PHP2Shell item on the homepage, status page or blog. The status page fetch showed \"All Systems Operational\" with no incident text after 19 October.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "buildops", "company": "BuildOps", "canonical_domain": "buildops.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:BuildOps PHP2Shell", "https://buildops.com/ (homepage)", "https://trust.buildops.com/ (trust center, no advisories or PHP mention)", "https://buildops.com/resource-category/company-news (newest item 2026-09-17)", "https://buildops.com/resource-category/product-updates (newest item 2026-10-14, no PHP mention)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page linked. Trust center lists no security advisories.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "buildxact", "company": "Buildxact", "canonical_domain": "buildxact.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Buildxact PHP2Shell", "https://www.buildxact.com/", "https://www.buildxact.com/us/company/responsible-disclosure/", "https://status.buildxact.com/", "https://www.buildxact.com/us/company/news-media/" ], "last_checked_utc": "2026-10-23T00:31:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Not a PHP2Shell statement: the Responsible Disclosure page (metadata modified 2024-05-02, pre-dating PHP2Shell) lists among out-of-scope issues \"Ability to upload PHP files (our system does not run PHP)\" quoted from https://www.buildxact.com/us/company/responsible-disclosure/. Status page shows a resolved Potential Downtime notice ended 14:06 AEDT 20 October 2026 with no security wording; news page undated, no PHP item.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "byte-software", "company": "Byte Software", "canonical_domain": "bytesoftware.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Byte Software PHP2Shell", "https://www.bytesoftware.com/", "https://bytesoftware.com/byte-support-notification/", "https://bytesoftware.com/compliance/" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust, status, blog or newsroom page linked from the site; footer \"News & Events\" link points to a careers anchor. Support notification page only directs users to the Byte Community support site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "calyx", "company": "Calyx", "canonical_domain": "calyxsoftware.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Calyx Software PHP2Shell", "https://www.calyxsoftware.com/", "https://www.calyxsoftware.com/blog (posts undated)", "https://www.calyxsoftware.com/get-support" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust, status or newsroom page linked from the site. Blog listing shows no publication dates.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "canon-medical-informatics", "company": "Canon Medical Informatics", "canonical_domain": "vitalimages.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Canon Medical Informatics PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.vitalimages.com/ (302 redirect to https://www.mi.medical.canon/, read)", "https://www.mi.medical.canon/support-and-services/customer-support/security-bulletins/ (newest bulletin Feb 11, 2026)", "https://www.mi.medical.canon/about-us/news/ (newest Feb 18, 2026)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "vitalimages.com redirects to mi.medical.canon. Security Bulletins page lists third-party component bulletins (SSMS, .NET, NVIDIA) with nothing after February 2026 and no PHP item. Coordinated Vulnerability Reporting page linked in footer.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "carestack", "company": "CareStack", "canonical_domain": "carestack.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://carestack.com/", "https://carestack.com/security", "https://carestack.com/blog (redirects to https://resources.carestack.com/article)", "https://resources.carestack.com/article (listing did not render)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Security page covers HIPAA storage and transmission with no PHP mention; homepage footer links all resolve to the homepage; article listing did not render; no status page link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "carestream-dental", "company": "Carestream Dental", "canonical_domain": "carestreamdental.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.carestreamdental.com/", "https://www.carestreamdental.com/en-us/", "https://www.carestreamdental.com/en-us/whats-new/ (fetch failed, client error)", "https://www.carestreamdental.com/en-us/csd-products/ (fetch failed, client error)", "https://www.carestreamdental.com/en-us/about-us/ (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Homepage navigation shows a What's New item and a cybersecurity webinar promotion without URLs; no PHP mention; deeper pages blocked the fetch.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "carestream-health", "company": "Carestream Health", "canonical_domain": "carestream.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Carestream Health PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.carestream.com/", "https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy (newest product security advisory dated 08/16/2023)", "https://www.carestream.com/en/us/newsandevents/news-releases (newest October 12, 2026)", "https://www.carestream.com/en/us/services-and-support" ], "last_checked_utc": "2026-10-23T01:40:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Cybersecurity and Privacy page carries a product security advisory table; newest entry \"July 2023 MS Patches\" (08/16/2023); no PHP item. Page states \"Security advisories and relevant security patch information for Carestream products will be provided below.\" (quoted from https://www.carestream.com/en/us/services-and-support/cybersecurity-and-privacy).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "caret-legal", "company": "CARET Legal", "canonical_domain": "caretlegal.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:CARET Legal PHP2Shell", "https://www.caretlegal.com/ (homepage, links security, status and blog, no notice)", "https://caretlegal.com/security/ (security page, metadata modified 2025-09-10, no PHP or CVE mention)", "https://status.caretlegal.com/ (StatusHub page, content requires JavaScript, no incident text retrieved)" ], "last_checked_utc": "2026-10-23T02:06:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No PHP2Shell item on the security page; the StatusHub status page did not render without JavaScript.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "cdk-global", "company": "CDK Global", "canonical_domain": "cdkglobal.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:CDK Global PHP2Shell", "https://www.cdkglobal.com/", "https://www.cdkglobal.com/cdk-trust-center", "https://www.cdkglobal.com/media-center" ], "last_checked_utc": "2026-10-23T00:35:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trust Center shows no dated security notices and no PHP mention; media center newest item October 13, 2026; no status page link in site navigation.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "centerbase", "company": "Centerbase", "canonical_domain": "centerbase.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Centerbase PHP2Shell", "https://www.centerbase.com/ (homepage, no notice)", "https://centerbase.com/security/ (security page, no PHP or CVE mention, no status, trust or blog link)", "https://status.centerbase.com/ (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T02:06:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Security page says only: \"We also continuously monitor our systems for vulnerability and malicious activity.\" quoted from https://centerbase.com/security/ (no specific advisory).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "check-point", "company": "Check Point", "canonical_domain": "checkpoint.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://support.checkpoint.com/results/sk/sk1000302", "statement_date": "Created 2026-10-21; last modified 2026-10-22", "status": "mitigation only", "fixed_version_named": "no", "workers_restart_stated": "yes", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://support.checkpoint.com/results/sk/sk1000302", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Check Point firewall web interfaces listed Vulnerable citing sk1000302)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "sk1000302 \"Check Point Response to CVE-2026-109618 and CVE-2026-109619 - PHP vulnerabilities may allow Remote Code Execution through Firewall web interfaces\". Affected when Mobile Access Portal, Remote Access VPN with SSL Network Extender, Remote Access VPN with SAML Realm or Identity Awareness Captive Portal is enabled: Force Firewalls R81.20, R82, R82.10, R82.20 (R80 to R81.10 EoS also listed) and Spark Firewalls R81.10.x, R82.00.x (R77.20.x, R80.20.x EoS also listed). Automatic mitigation via Automatic Updates before 22 Oct 2026 21:00 GMT; manual cp-httpd.conf procedures restart portal services; IPS signature on R82.20. \"The fix is planned for the release on November 11, 2026, as part of the Jumbo Hotfix Accumulators.\" and \"Check Point Portal and SaaS services are already patched against these vulnerabilities.\" quoted from the statement URL. No fix stated for EoS versions.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "checkmk", "company": "Checkmk", "canonical_domain": "checkmk.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://checkmk.com/werks?product=cma (fetch failed, robots disallowed)", "https://download.checkmk.com/appliance/1.7.25/ChangedPackages (returned as binary data, unreadable)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Checkmk Appliance listed Fix in 1.7.25 citing the werks page and this manifest)", "fetch limit, retry next hour" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Neither Checkmk page that NCSC-NL cites could be read in this run, so no statement is confirmed here. Reported by NCSC-NL inventory (status update 23 Oct 2026): Checkmk Appliance 1.7.25 upgrades bundled PHP 8.2 packages from 8.2.34 to 8.2.35, the upstream fixed release. Unverified until a Checkmk page is read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "cisco", "company": "Cisco", "canonical_domain": "cisco.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq", "statement_date": "2026 October 21 19:12 GMT (Last Updated 2026 October 22 14:13 GMT, Version 1.2 Interim)", "status": "not affected", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (many Cisco products listed Investigation, Cisco AI Defense and Umbrella Not vuln citing this advisory)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Advisory cisco-sa-php-october26-Jj384Daq \"Vulnerabilities in PHP Affecting Cisco Products: October 2026\" (interim). \"Currently, no products are known to be affected.\" and \"There are no workarounds that address these vulnerabilities.\" quoted from the advisory URL. Mixed: confirmed not vulnerable: AI Defense (hybrid on-premises), Business Process Automation, Policy Suite, Ultra Cloud Core PCF and SMI, Secure Email Threat Defense, Umbrella; under investigation: ISE, Catalyst Center, Catalyst SD-WAN Manager, Hypershield, Expressway, Nexus Dashboard Insights, Meraki, Webex, Splunk, Slido, AppDynamics and more. No fixed releases named; Cisco PSIRT not aware of malicious use.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Cisco affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—some Cisco products are confirmed affected, but Cisco’s advisory does not yet list an available patch for them. As of October 23, 2026, the latest advisory is version 1.4, updated October 22, 2026, at 23:00 GMT, covering both CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). | Confirmed affected product | Fix listed by Cisco | Availability | |---|---|---| | Ultra-Reliable Wireless Backhaul", "cited_urls": [ "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Cisco affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of Cisco's status regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619), based on the latest available sources: 🔍 What Is PHP2Shell? CVE-2026-109618 and CVE-2026-109619 are critical remote code execution (RCE) vulnerabilities in PHP. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. CVE-2026-109618 stems from how PHP handles out-of-memory", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.configlane.io/en/blog/php2shell-cisco-sicherheitsluecken" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Cisco affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Cisco has not confirmed any affected products for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) as of its October 22, 2026 advisory. However, Cisco is still investigating multiple products and cloud services, so this is not yet a definitive “not affected” determination. Cisco’s advisory does not list a Cisco product-level patch or fixed release, and it says there are no workarounds. If", "cited_urls": [ "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq", "https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/", "https://www.configlane.io/en/blog/php2shell-cisco-sicherheitsluecken", "https://www.secnews.gr/en/742100/php-cve-2026-109618-109619-critical-effects/", "https://github.com/hkoeck/php2shell-status", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/", "https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/", "https://sec.cloudapps.cisco.com/security/center/publicationService.x?criteria=exact&cves=&keyword=&last_published_date=&limit=20&offset=0&publicationTypeIDs=1", "https://sec.cloudapps.cisco.com/security/center/psirtrss10/CiscoSecurityAdvisory.xml", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is Cisco affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Cisco is currently investigating its product line for potential exposure to PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Investigation Status: In its official advisory, Cisco stated that it is reviewing roughly 30 of its products and cloud services (including Identity Services Engine, Catalyst Center, and the AppDynamics PHP Agent). Current Confirmation: As of the latest update, Cisco has not confirmed any products", "cited_urls": [ "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq", "https://www.upguard.com/blog/php2shell-a-clear-explanation-and-response-framework", "https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/amp/", "https://community.cisco.com/t5/duo-release-notes/duo-access-gateway-3-2-0-released-2026-10-21/tac-p/5583260", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Cisco affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Cisco is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) if it runs vulnerable PHP runtime engines in its software or appliances, and Cisco Talos has issued network intrusion prevention (SNORT) signatures rather than direct universal software patches for all third-party components. Affected Scope & Details The Vulnerability: PHP2Shell consists of two critical memory-safety remote code execution (RCE) flaws", "cited_urls": [ "https://blog.talosintelligence.com/two-critical-rces-in-php-core/", "https://blog.ogwilliam.com/post/php2shell-cve-2026-109618-cve-2026-109619-rce-vulnerability", "https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "citrix-netscaler", "company": "Citrix NetScaler", "canonical_domain": "netscaler.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/ (fetch failed twice, client error)", "https://support.citrix.com/securitybulletins (page loads only a JavaScript shell, no content readable)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (NetScaler ADC listed Vulnerable citing this Citrix community security-updates post)", "fetch limit, retry next hour" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "The Citrix community security-updates post that NCSC-NL cites could not be read in this run, so no statement is confirmed here. Reported by NCSC-NL inventory (status update 23 Oct 2026): NetScaler's PHP-based Management Portal (NSIP GUI, management-enabled SNIP GUI, Cluster IP GUI) impacted in all supported software versions, fixed package pending, Console and SVM not impacted. Unverified until the Citrix page is read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "clickup", "company": "ClickUp", "canonical_domain": "clickup.com", "group": "index_vendor", "index_category": "project_management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:ClickUp PHP2Shell", "https://clickup.com/security (security page, no PHP or CVE mention)", "https://clickup.com/security/disclosures (security disclosures, only advisory CVE-2024-23755, 8 Mar 2024)", "https://status.clickup.com/ (status page, \"We're fully operational.\", no October 2026 entries)" ], "last_checked_utc": "2026-10-23T02:16:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No PHP2Shell disclosure. Status page reads \"We're not aware of any issues affecting our systems.\" quoted from https://status.clickup.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "clientrax", "company": "ClienTrax", "canonical_domain": "clientrax.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.clientrax.com/", "https://www.clientrax.com/support-training/", "https://www.clientrax.com/contact-support/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust, status, news or blog page on clientrax.com; support pages last dated 2018 and 2024. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "clio", "company": "Clio", "canonical_domain": "clio.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Clio PHP2Shell", "https://www.clio.com/security/ (security page, metadata modified May 1, 2026, no PHP or CVE mention)", "https://trust.clio.com/ (trust center, one undated update about a SOC 2 Type II report, no PHP mention)", "https://status.clio.com/ (status hub, incident history did not load in the fetch)", "https://www.clio.com/about/press/ (press list, items undated, none on PHP)" ], "last_checked_utc": "2026-10-23T02:03:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No PHP2Shell item on the security page, trust center or press list. The status hub links regional pages and showed no incident text in the fetch.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "clock-pms", "company": "Clock PMS+", "canonical_domain": "clock-software.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Clock PMS+ PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.clock-software.com/ (homepage", "no security or trust link)", "https://www.clock-software.com/service-status (status page", "live charts only, no incident text, no PHP mention)", "https://www.clock-software.com/blog (newest posts 22 Oct 2025)", "https://www.clock-software.com/changelog (newest entry Sep 9, 2026, no PHP mention)", "https://www.clock-software.com/legal (legal page, no security page linked)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "The service status page shows availability charts only; no incident or notice text is published there.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "close", "company": "Close", "canonical_domain": "close.com", "group": "index_vendor", "index_category": "crm", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Close CRM close.com PHP2Shell", "https://close.com/security (security page, no PHP or CVE mention, links trust.close.com and status)", "https://status.close.com/ (status page)", "https://www.close.com/blog (newest posts October 20, 2026, none on PHP)" ], "last_checked_utc": "2026-10-23T02:17:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for Oct 20 and Oct 21, 2026 and \"No incidents reported today.\" for Oct 22, 2026, quoted from https://status.close.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "cloudbeds", "company": "Cloudbeds", "canonical_domain": "cloudbeds.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Cloudbeds PHP2Shell", "https://www.cloudbeds.com/ (homepage)", "https://www.cloudbeds.com/security/ (security page, no PHP or CVE mention)", "https://www.cloudbeds.com/newsroom/ (newest item October 20, 2026, Meta Muse integration, no PHP mention)", "https://www.cloudbeds.com/press/meta-muse-integration/ (press release dated October 20, 2026, no PHP or security patch mention)", "https://www.cloudbeds.com/product-updates/ (October 2026 items, month only, no PHP mention)", "https://status.cloudbeds.com/ (status page", "22 Oct 2026 incident is a Booking.com connection outage, unrelated to PHP)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page incident October 22, 2026 \"Booking.com connection impacted\" is unrelated to PHP. Newest newsroom item (October 20, 2026) is a product announcement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "cloudflare", "company": "Cloudflare", "canonical_domain": "cloudflare.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/", "statement_date": "October 21, 2026", "status": "mitigation only", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://blog.cloudflare.com/php-vulnerabilities-waf-protection/", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:42:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Cloudflare customers using our free or paid WAF were protected by default against php2shell", "notes": "\"Cloudflare customers using our free or paid WAF were protected by default against php2shell\" (from October 21 at 3:02 am UTC) and \"Customers should patch their PHP repos even with WAF protections\" quoted from https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ (title: Cloudflare deploys protections against php2shell vulnerability; authors Daniele Molteni, Dan Jones, Kuber Nandwani). New rules in the Cloudflare Managed Free Ruleset and Cloudflare Managed Ruleset plus a response-side full transaction rule for all plans; the post does not say whether Cloudflare's own services run PHP or are affected and names no fixed PHP version.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "cloudlinux", "company": "CloudLinux", "canonical_domain": "cloudlinux.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5", "statement_date": "Oct 22, 2026 - 19:50 UTC (latest update; Investigating Oct 20, 2026 - 21:00 UTC)", "status": "patched", "fixed_version_named": "yes: upstream PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; alt-php 5.2 to 8.5 and ea-php52 to ea-php85 with backported fixes (version numbers unchanged); native PHP packages per CloudLinux release", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5", "search:CloudLinux PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers (topsitehosters.com links this incident)", "https://blog.cloudlinux.com/ (not read, fetch limit)" ], "last_checked_utc": "2026-10-23T01:08:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "are now in the stable channel for every affected version", "notes": "\"are now in the stable channel for every affected version\" (native PHP packages, Oct 22, 2026 - 19:50 UTC), \"Fixed alt-php packages for CVE-2026-109618 and CVE-2026-109619 are available in the CloudLinux OS repositories\" (Oct 22, 2026 - 01:19 UTC) and \"These packages contain the fix for both CVEs, even though the PHP version number is lower.\" quoted from https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5 (title: Critical PHP vulnerabilities CVE-2026-109618 / CVE-2026-109619 - release 21 October 2026, 14:00 UTC; CloudLinux's status page). Vendor release: hosters must update ea-php, alt-php or native PHP packages and restart Apache, PHP-FPM or LiteSpeed; Imunify360 rulesets 8.83 to 8.85 are an interim mitigation; PHP 8.1 and older get no PHP-project release, minimal backports exist for 7.4, 8.0, 8.1; PHP 8.2 EOL 31 December 2026. Security advisory metadata (OVAL/UpdateInfo) not yet published at 00:52 UTC.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "cloudways", "company": "Cloudways", "canonical_domain": "cloudways.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://status.cloudways.com/incidents/xxjt802wwhpk", "statement_date": "Oct 22, 2026 - 10:20 UTC (completion; latest Oct 22, 2026 - 10:22 UTC; first Oct 21, 2026 - 09:16 UTC)", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://status.cloudways.com/incidents/xxjt802wwhpk", "https://status.cloudways.com/", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:28:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "The PHP security patch rollout is complete, and all active servers have been successfully updated.", "notes": "\"The PHP security patch rollout is complete, and all active servers have been successfully updated.\" quoted from https://status.cloudways.com/incidents/xxjt802wwhpk (title: Critical PHP Remote Code Execution Vulnerabilities - Monitoring & Mitigations Underway). Autonomous patched at 01:02 UTC, Flexible deployment from 04:07 UTC; branches named 5.6, 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 with no point releases; \"For deprecated PHP versions, we are working with our ELTS partners to apply the appropriate security patches.\" \"No action is needed from the customers.\" Support contacting a small subset of customers.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Cloudways affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Cloudways was affected, and it now reports that patching is complete. As of October 23, 2026, the official sources say: Affected: DigitalOcean’s advisory for CVE-2026-109618 and CVE-2026-109619 explicitly lists Cloudways as “Affected”, with remediation handled by DigitalOcean. It covers Cloudways-supported PHP versions from 5.6 onward, using extended-LTS partners for older versions. Patched: Cloudways’ official status update dated October 22,", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://status.cloudways.com/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Cloudways affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes — Cloudways is affected by PHP2Shell, and patching is actively in progress. Here is a full breakdown: What is PHP2Shell? PHP2Shell is a pair of high-impact vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — in PHP versions 5.4–8.5 that allow remote code execution (RCE). Both are rated CVSS v4.0 9.2. Both CVEs are use-after-free bugs: a fatal error during a", "cited_urls": [ "https://en.wikipedia.org/wiki/PHP2Shell", "https://sansec.io/research/php2shell", "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Cloudways affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Cloudways was affected because the PHP2Shell vulnerabilities affect PHP installations broadly, including the PHP versions used on Cloudways. DigitalOcean states that Cloudways was actively patching supported PHP versions, including PHP 5.6 and newer, while applying temporary mitigations and targeted WAF rules during the rollout. As of October 22, Cloudways reported that patching was complete across active Autonomous and", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://meowapps.com/php2shell-wordpress/", "https://github.com/hkoeck/php2shell-status", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/NCSC-NL/php2shell", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://sansec.io/research/php2shell", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell", "https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Cloudways affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Cloudways is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and patching is currently in progress. Status: Affected and actively being patched. Actions Taken by Cloudways / DigitalOcean: Cloudways is actively patching supported PHP versions (5.6 and above) using extended LTS partnership support for older PHP instances without forcing customers to migrate versions. Temporary Mitigations: Cloudways has applied PHP's", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Cloudways affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: Cloudways itself is a managed hosting platform, but the servers and applications it hosts run PHP. Because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) affects the core PHP runtime engine across virtually all unpatched versions, any Cloudways server running an unpatched version of PHP is inherently vulnerable to unauthenticated remote code execution. Patch Status: Official security patches for PHP were", "cited_urls": [ "https://www.wiz.io/blog/php2shell-php-rce", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation", "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "cmic", "company": "CMiC", "canonical_domain": "cmicglobal.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:CMiC PHP2Shell", "https://cmicglobal.com/security (fetch failed, client error)", "https://cmicglobal.com/", "https://cmicglobal.com/blog", "https://cmicglobal.com/about-us/press" ], "last_checked_utc": "2026-10-23T00:21:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status link in site navigation; blog newest item 17 Aug 2026; press page shows no dates and no PHP item.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "commusoft", "company": "Commusoft", "canonical_domain": "commusoft.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Commusoft PHP2Shell", "https://www.commusoft.us/ (302 redirect to https://www.commusoft.com/en-us/)", "https://www.commusoft.com/en-us/ (homepage)", "https://status.commusoft.com/ (status page)", "https://www.commusoft.com/en-us/blog/ (newest dated post 29 September 2026)", "https://www.commusoft.com/en-us/company/press-and-media/ (newest item 18 September 2026)", "https://www.commusoft.com/en-us/security/ (security page, no PHP or CVE mention, modified 2025-12-08)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page reads \"No notices reported for the past 7 days\" quoted from https://status.commusoft.com/. Security page speaks only generally of applying \"the latest patches and updates to both the Linux operating system and other key components of the Commusoft infrastructure\" (quoted from https://www.commusoft.com/en-us/security/), with no PHP or CVE named.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "condo-control", "company": "Condo Control", "canonical_domain": "condocontrol.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Condo Control PHP2Shell", "search:Condo Control PHP2Shell CVE-2026-109618", "https://www.condocontrol.com/", "https://status.condocontrol.com/ (redirects to https://status.propertycontrol.com/)", "https://status.propertycontrol.com/", "https://www.condocontrol.com/blog/" ], "last_checked_utc": "2026-10-23T00:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page (status.propertycontrol.com) shows All Systems Operational and no incidents 20 to 22 October 2026; only incident listed is 8 October 2026 support ticket degradation. No security or trust page found. Blog posts undated, none on security. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "constructiononline", "company": "ConstructionOnline", "canonical_domain": "constructiononline.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:ConstructionOnline UDA Technologies PHP2Shell", "https://www.constructiononline.com/ (loaded without body content)", "https://news.constructiononline.com/" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Newsroom newest items 20 Oct 2026 (AI assistant preview) and 19 Oct 2026 (weekly Publish Report) mention no PHP or CVE; the 19 Oct report pre-dates the PHP fix release and speaks only of general improvements.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "contractor-foreman", "company": "Contractor Foreman", "canonical_domain": "contractorforeman.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Contractor Foreman PHP2Shell", "https://contractorforeman.com/security/ (glossary page, not a security notice page)", "https://contractorforeman.com/", "https://contractorforeman.com/blog/", "https://contractorforeman.com/press-releases/", "https://status.contractorforeman.com/ (fetch failed, robots disallowed)", "http://status.contractorforeman.net/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:19:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security or trust page found in site navigation; blog newest post dated October 21, 2026 is about custom reports, no PHP mention; press releases newest September 2026.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "convesio", "company": "Convesio", "canonical_domain": "convesio.com", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://status.convesio.com/ (fetch failed, robots_disallowed)", "https://convesio.com/blog/ (21 Oct 2026 post is about ConvesioPay, no PHP post)", "https://convesio.com/ (no banner)", "https://convesio.com/security/ (no notice", "last modified 2025-04-03)", "https://support.convesio.com/ (support stats dashboard, no articles)", "search:Convesio PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:33:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Nothing found on the blog, homepage, security page or support dashboard; the status page could not be fetched (robots_disallowed).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "coolify", "company": "Coolify", "canonical_domain": "coolify.io", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://github.com/coollabsio/coolify/issues/12266", "statement_date": "Oct 21, 2026", "status": "patched", "fixed_version_named": "yes: Coolify v4.0.1, v4.1.3, v4.2.1, v4.3.24 and v4.4.7 (recommended)", "workers_restart_stated": "yes", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://github.com/coollabsio/coolify/issues/12266", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Coolify listed Fix citing this issue)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Pinned issue \"Security: update Coolify now for PHP2Shell (CVE-2026-109618, CVE-2026-109619)\" by maintainer peaklabs-dev on the project's official GitHub repository: the flaws \"affect every Coolify v4 version. Update your instance immediately.\" and \"We backported the fix to every v4 line, so you can update without leaving your minior version.\" quoted from the issue URL. v4.4 users update from the dashboard; v4.0 to v4.3 users run the patch script, which restarts only the Coolify container; beta or older installs reinstall v4.0.1 then update to v4.4.7. Temporary PHP mitigations only if updating is impossible; also update Sentinel, cloudflared 2026.10.3 and own Node.js runtimes.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "copper", "company": "Copper", "canonical_domain": "copper.com", "group": "index_vendor", "index_category": "crm", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Copper CRM PHP2Shell", "https://www.copper.com/security (security page, no PHP or CVE mention)", "https://trust.copper.com/ (fetch failed, client error)", "https://status.copper.com/ (status page)" ], "last_checked_utc": "2026-10-23T02:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for October 20 and 21, 2026 and \"No incidents reported today.\" for October 22, 2026, quoted from https://status.copper.com/. A scheduled maintenance for October 24, 2026 (posted October 19, 2026) gives no reason and does not mention PHP.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "cosmolex", "company": "CosmoLex", "canonical_domain": "cosmolex.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:CosmoLex PHP2Shell", "https://www.cosmolex.com/security/ (fetch failed, client error)", "https://status.cosmolex.com/ (302 redirect to https://cosmolex.statuspage.io/inactive, an inactive status page)", "https://www.cosmolex.com/ (homepage, footer security link is a feature page, no trust, status or newsroom link, no notice)", "https://www.cosmolex.com/blog/ (blog, posts undated, none on PHP)" ], "last_checked_utc": "2026-10-23T02:06:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "status.cosmolex.com redirects to an inactive Statuspage address. No PHP2Shell item on the homepage or blog.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "covetrus-pulse", "company": "Covetrus Pulse", "canonical_domain": "covetrus.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.covetrus.com/", "https://covetrus.com/about/newsroom/", "https://covetrus.com/insights-center/", "https://covetrus.com/legal/", "https://status.covetrus.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or vulnerability disclosure page on covetrus.com; newsroom and insights items undated (page modified 7 October 2026). Same check covers the Covetrus products AVImark and ImproMed. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "cpanel", "company": "cPanel", "canonical_domain": "cpanel.net", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/", "statement_date": "2026 October 21 (EasyApache 4 release 25.91)", "status": "patched", "fixed_version_named": "yes: ea-php85 8.5.12, ea-php84 8.4.27, ea-php83 8.3.36, ea-php82 8.2.35; fixes backported to ea-php81, ea-php80, ea-php74", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://blog.cpanel.com/ (redirects to https://www.cpanel.net/blog/, newest post 16 Sep 2026)", "https://news.cpanel.com/ (newest item Oct 2025)", "https://support.cpanel.net/hc/en-us (no article)", "https://support.cpanel.net/hc/en-us/community/topics (index only)", "https://docs.cpanel.net/changelogs/easyapache-4-changelog/ (fetch failed, client_error)", "https://docs.cpanel.net/changelogs/", "https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/", "search:cPanel PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "EasyApache 4 release 25.91 (2026 October 21): \"EA-13607: Update `ea-php85` from v8.5.11 to v8.5.12.\" and \"EA-13611: Backport the fix for CVE-2026-109618 and CVE-2026-109619 to `ea-php81`.\" (likewise EA-13612 for ea-php80 and EA-13613 for ea-php74; ea-php82 to 8.2.35, ea-php83 to 8.3.36, ea-php84 to 8.4.27) quoted from https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/; each entry lists \"Two vulnerabilities in PHP (critical)\". This is a product changelog, not an advisory: no blog, news, support or community post was found; server administrators install the EA4 packages (see hosts' notices such as Liquid Web and Bluehost).", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is cPanel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—cPanel & WHM is affected, and cPanel released fixes for both CVE-2026-109618 and CVE-2026-109619 on October 21, 2026. There are two separate components to check: internal cPanel PHP and the EasyApache PHP used by hosted websites. | Component | Fixed releases | |---|---| | Internal PHP, used by cPanel interfaces, including Roundcube webmail | 138.0.18, 136.0.50, and 134.0.66 include", "cited_urls": [ "https://docs.cpanel.net/release-notes/release-notes/", "https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is cPanel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, cPanel is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and patches have been released. Here is a detailed breakdown: What Is PHP2Shell? PHP2Shell refers to two critical vulnerabilities in PHP that can allow unauthenticated remote code execution. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. | CVE | Type |", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://computingforgeeks.com/patch-php2shell-cpanel-whm/", "https://phpvulnerability.org/cpanel/", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is cPanel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. cPanel systems are affected because the vulnerabilities are in PHP itself, including PHP installations managed through cPanel/EasyApache—not necessarily in the cPanel interface code. Patching status: cPanel has released fixed EasyApache packages. EasyApache 4 updates ea-php82–ea-php85 to PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, which contain the fixes for CVE-2026-109618 and CVE-2026-109619. cPanel also reportedly backported fixes for ea-php74, ea-php80,", "cited_urls": [ "https://www.panellicense.com/kb/php2shell-cve-2026-109618-109619-hosting-servers/", "https://www.digitalapplied.com/blog/php2shell-fixes-by-distro-control-panel-php-version", "https://github.com/hkoeck/php2shell-status", "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC", "https://smarthost.ie/php-security-alert-21-10-26/amp/", "https://www.greenbone.net/en/blog/php2shell-remote-code-execution-cve-2026-109618-cve-2026-109619/", "https://mallory.ai/blog/php-rce-rapid-response", "https://www.vpsbg.eu/blog/2-critical-php-vulnerabilities-found-php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:18:09.009Z", "question": "Is cPanel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, cPanel and WHM installations are affected because they use PHP packages (such as EasyApache 4 builds), though the vulnerabilities themselves reside in the PHP core runtime rather than cPanel's custom code. cPanel has released patches for the affected PHP versions (ea-php74 and newer). How to Patch and Verify on cPanel/WHM Update packages: Run package updates via the command", "cited_urls": [ "https://www.reddit.com/r/webhosting/comments/1xc4wzj/php2shell_some_shared_hosts_still_havent_patched/", "https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619", "https://computingforgeeks.com/patch-php2shell-cpanel-whm/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is cPanel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "The cPanel platform is affected by the PHP2Shell vulnerabilities, as it ships with and supports various PHP versions (ea-php). However, cPanel has already released patches to mitigate the issue. According to the official cPanel Knowledge Base Advisory, all shipped PHP versions were initially suspected to be vulnerable. To address CVE-2026-109618 and CVE-2026-109619, cPanel released updates for EasyApache PHP versions", "cited_urls": [ "https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619", "https://www.picussecurity.com/resource/php2shell-the-two-critical-php-rce-flaws-cve-2026-109618-cve-2026-109619-explained" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "craft-cms", "company": "Craft CMS", "canonical_domain": "craftcms.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://craftcms.com/blog/craft-cloud-and-php2shell", "statement_date": "October 21, 2026", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://craftcms.com/blog", "https://craftcms.com/blog/craft-cloud-and-php2shell", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Craft CMS listed Vulnerable citing requirements only)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"Craft Cloud and php2shell\" (Pixel & Tonic) names CVE-2026-109618 and CVE-2026-109619. Craft Cloud runs on Bref; new Bref images were pulled in and rolled out. \"Save for a small handful of sites with preexisting build issues, at this point all Cloud environments have now been updated to the new images, and are fully protected.\" quoted from https://craftcms.com/blog/craft-cloud-and-php2shell. Cloudflare emergency firewall rules credited with protecting Cloud sites before the fix, no known successful attacks. Covers Craft Cloud only; self-hosted Craft installs not addressed.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "curve-dental", "company": "Curve Dental", "canonical_domain": "curvedental.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.curvedental.com/", "https://www.curvedental.com/status", "https://www.curvedental.com/news-and-events", "https://www.curvedental.com/blog" ], "last_checked_utc": "2026-10-23T01:14:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Status page shows five systems with no incident history (timestamp Oct 22, 2026, 9:16:12 PM); news newest September 29, 2026; blog newest October 18, 2026; no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "daysmart-vet", "company": "DaySmart Vet", "canonical_domain": "daysmart.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.daysmart.com/", "https://www.daysmart.com/blog/", "https://www.daysmart.com/customer-support/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or status page on daysmart.com. Newest blog post 21 May 2026. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dealerbuilt", "company": "DealerBuilt", "canonical_domain": "dealerbuilt.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.dealerbuilt.com/", "https://dealerbuilt.com/about-us/commitment-to-information-security/", "https://dealerbuilt.com/about-us/news-media/" ], "last_checked_utc": "2026-10-23T01:06:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Commitment to Information Security page (metadata last modified June 16, 2025) is a general security statement with no PHP mention; news newest item September 18, 2025; no status page link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dealercenter", "company": "DealerCenter", "canonical_domain": "dealercenter.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.dealercenter.com/", "https://www.dealercenter.com/blog", "https://www.nowcom.com/" ], "last_checked_utc": "2026-10-23T01:04:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust, status or news link in site navigation; blog has three posts, newest July 27, 2026; parent Nowcom homepage has no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dealersocket", "company": "DealerSocket", "canonical_domain": "dealersocket.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:DealerSocket PHP2Shell", "https://dealersocket.com/", "https://dealersocket.com/news/", "https://dealersocket.com/resources/dealersocket-blog/" ], "last_checked_utc": "2026-10-23T00:37:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status link in site navigation (privacy links point to parent Solera); news newest item November 18, 2021; blog newest post April 22, 2024.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dealertrack", "company": "Dealertrack", "canonical_domain": "dealertrack.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Dealertrack Cox Automotive PHP2Shell", "https://us.dealertrack.com/", "https://us.dealertrack.com/content/dealertrack/en/security-matters.html", "https://casfx.my.site.com/DMS/s/dmshealth (loaded only a loading/CSS error screen)", "https://www.coxautoinc.com/newsroom/" ], "last_checked_utc": "2026-10-23T00:36:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Security Matters page is a general security-awareness guide (metadata last modified 2025-02-28), no PHP mention; parent Cox Automotive newsroom newest items 22 Oct 2026 are market content, no PHP mention; DMS System Health page did not render.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "defi-solutions", "company": "defi SOLUTIONS", "canonical_domain": "defisolutions.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:defi SOLUTIONS PHP2Shell", "https://www.defisolutions.com/", "https://defisolutions.com/press-room/ (newest October 21, 2026)", "https://defisolutions.com/press-room/more-than-half-of-americans-are-considering-a-loan-within-the-next-year-despite-inflation-and-high-rates-defi-solutions-survey-finds (dated October 21, 2026, consumer survey, no PHP content)", "https://defisolutions.com/defi-blog/ (posts undated)", "https://status.defisolutions.com/ (302 redirect to https://defisolutions.statuspage.io/inactive)" ], "last_checked_utc": "2026-10-23T01:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security or trust page linked from the site. The status page URL redirects to an inactive Statuspage address.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dentally", "company": "Dentally", "canonical_domain": "dentally.co", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://dentally.co/ (redirects to https://www.dentally.com/en-gb/)", "https://www.dentally.com/en-gb/", "https://www.dentally.com/en-gb/security-policy", "https://www.dentally.com/en-gb/insights-hub" ], "last_checked_utc": "2026-10-23T01:17:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Security policy page last updated 23rd June 2020, no PHP mention; Insights Hub newest post 22nd October 2026 (\"2027 practice readiness\") with no PHP or security wording in its listing; no status page link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dentimax", "company": "DentiMax", "canonical_domain": "dentimax.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.dentimax.com/", "https://dentimax.com/blog/", "https://dentimax.com/industry-recognition-reputation/" ], "last_checked_utc": "2026-10-23T01:24:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust, status or news link in site navigation; blog newest post September 29, 2026.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dentrix", "company": "Dentrix", "canonical_domain": "dentrix.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.dentrix.com/", "https://www.dentrix.com/insights/blogs/ (listings did not render)", "https://whatsnew.dentrix.com/", "https://whatsnew.dentrix.com/october-2026-releases/ (fetch failed, client error)", "https://www.henryscheinone.com/about-us/press-release/ (listings did not render)", "https://www.henryscheinone.com/" ], "last_checked_utc": "2026-10-23T01:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. whatsnew.dentrix.com newest item \"October 2026 Releases\" dated Oct 21, 2026 lists Family File, Ledger and Claims Manager changes in its summary with no PHP or security wording; the full post could not be opened. Dentrix, Dentrix Ascend and Dentrix Enterprise are Henry Schein One products; the Henry Schein One press release listing did not render and its homepage shows no security or status link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dentrix-ascend", "company": "Dentrix Ascend", "canonical_domain": "dentrixascend.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.dentrixascend.com/", "https://learn.dentrixascend.com/product-news-updates/", "https://www.henryscheinone.com/about-us/press-release/ (listings did not render)", "https://www.henryscheinone.com/" ], "last_checked_utc": "2026-10-23T01:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Product News & Updates page lists October 2026 early-access features and a \"New Security Rights for Custom Imaging Procedures\" item (access rights, not a vulnerability fix); no PHP mention. Dentrix, Dentrix Ascend and Dentrix Enterprise are Henry Schein One products; the Henry Schein One press release listing did not render and its homepage shows no security or status link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dentrix-enterprise", "company": "Dentrix Enterprise", "canonical_domain": "dentrixenterprise.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.dentrixenterprise.com/ (loaded metadata only, no body content)", "https://www.dentrixenterprise.com/insights/blogs/ (fetch failed, client error)", "https://www.dentrixenterprise.com/blog/ (fetch failed, client error)", "https://www.dentrixenterprise.com/resources/ (fetch failed, client error)", "https://www.dentrixenterprise.com/about/", "https://www.henryscheinone.com/about-us/press-release/ (listings did not render)", "https://www.henryscheinone.com/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Company site returned little readable content. Dentrix, Dentrix Ascend and Dentrix Enterprise are Henry Schein One products; the Henry Schein One press release listing did not render and its homepage shows no security or status link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "descartes", "company": "Descartes", "canonical_domain": "descartes.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Descartes Systems PHP2Shell CVE-2026-109618", "https://www.descartes.com/security (fetch failed)", "https://www.descartes.com/news-events/news-releases (fetch failed)", "https://www.descartes.com/", "https://www.descartes.com/resources/legal-compliance", "https://www.descartes.com/resources/news", "https://www.descartes.com/news-events/descartes-news" ], "last_checked_utc": "2026-10-23T00:21:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security advisory, trust center or status page found on descartes.com; legal-compliance page has no advisories. Newest news item 14 October 2026. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "descartes-3g-tms", "company": "Descartes 3G TMS", "canonical_domain": "3gtms.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.3gtms.com/", "https://3gtms.com/resources/news/", "https://3gtms.com/company/support/" ], "last_checked_utc": "2026-10-23T01:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or status page on 3gtms.com; support page last updated 3 September 2026. News items undated, none on security. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "descartes-aljex", "company": "Descartes Aljex", "canonical_domain": "aljex.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.aljex.com/", "https://www.aljex.com/news/", "https://www.aljex.com/support/" ], "last_checked_utc": "2026-10-23T01:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or status page on aljex.com; news items undated, none on security. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "devolutions", "company": "Devolutions", "canonical_domain": "devolutions.net", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://devolutions.net/blog/php2shell-what-devolutions-customers-should-know/", "statement_date": "October 21, 2026", "status": "not affected", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (PHP project fixes cited; Devolutions products need no update)", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://devolutions.net/blog/php2shell-what-devolutions-customers-should-know/", "search:Devolutions PHP2Shell (statement URL supplied by desk)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (no Devolutions entry)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"PHP2Shell: what Devolutions customers should know\": \"Devolutions products and services are not affected by PHP2Shell\" because they do not use PHP; \"no additional updates, configuration changes, or actions are required on their part\"; \"PHP 8.1 and older no longer receive updates from the PHP project.\" All quoted from the statement URL. Notes that the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1 and that some vendors are backporting fixes; \"Updating is the only safe choice.\"", "ai_answer_note": null, "ai_answers": [] }, { "slug": "digitail", "company": "Digitail", "canonical_domain": "digitail.io", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://digitail.io/ (redirects to https://digitail.com/)", "https://digitail.com/", "https://status.digitail.io/", "https://digitail.com/blog/category/news/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. Status page shows all services operational (last updated 23 October 2026 01:19 UTC) with no incidents or maintenance 20 to 23 October. No security or trust page; news items undated. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "digitalocean", "company": "DigitalOcean", "canonical_domain": "digitalocean.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "statement_date": "Updated: October 21, 2026", "status": "patched partly", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:38:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Droplets don't include PHP by default.", "notes": "\"Droplets don't include PHP by default.\" (customers who installed PHP must update it); App Platform PHP buildpack patched: \"Redeploy applications to pick up the latest buildpack and safe PHP.\"; 1-Click/Marketplace: \"Instances you already deployed don't update themselves. Update PHP on them now.\"; \"Restart PHP-FPM or your web server after updating so the new version is loaded.\"; \"If you're running an end-of-life version (8.1 or earlier), no official patch will be available.\" quoted from https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now (author Tim Lisko, Deputy CISO). Functions runtimes patched (PHP 8.0 deprecated); SnapShooter fully patched; Cloudways patching 5.6 and above; Managed Databases not affected. Mixed: managed products patched or require redeploy, unmanaged compute is the customer's responsibility.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is DigitalOcean affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—some DigitalOcean products were affected, and patches have been deployed, but customer-managed PHP workloads are not automatically fixed. DigitalOcean’s official advisory explicitly covers both CVE-2026-109618 and CVE-2026-109619. Status as of October 23, 2026: | Product | Patch status / required action | |---|---| | App Platform | PHP buildpack patched. Redeploy applications to receive the fix; custom containers require", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://status.cloudways.com/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is DigitalOcean affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, DigitalOcean is aware of and affected by PHP2Shell, and has communicated patch availability. Here is a detailed breakdown: PHP2Shell (CVE-2026-109618 & CVE-2026-109619): DigitalOcean's Status What is PHP2Shell? PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in PHP that can allow unauthenticated remote code execution. Specifically: CVE-2026-109618 – RCE via OOM corruption: out-of-memory handling can interrupt PHP while", "cited_urls": [ "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is DigitalOcean affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. DigitalOcean is affected wherever customers run PHP, including Droplets, DOKS workloads, App Platform applications, custom containers, and existing Marketplace 1-Click images. DigitalOcean says PHP versions from 5 onward are potentially affected. Patch status: App Platform: The PHP buildpack has been patched, but applications must be redeployed. Apps using a custom Dockerfile or container image require the customer to", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://x.com/digitalocean/status/2112953857496195200", "https://php2shellcheck.com/hosting-status/", "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619", "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is DigitalOcean affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, DigitalOcean's ecosystem and certain hosted products are affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the status of the patches depends on the specific DigitalOcean product being used . DigitalOcean addressed the incident and outlined specific product statuses in its official advisory: Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) | DigitalOcean. Product Patch Status on DigitalOcean", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://www.youtube.com/watch?v=cOFt72z7cq8" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is DigitalOcean affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "DigitalOcean itself is not the vulnerable entity, but user droplets, virtual private servers (VPS), and apps running unpatched PHP instances on DigitalOcean infrastructure are directly affected by CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Because DigitalOcean provides cloud infrastructure rather than managing user-level application runtimes, you (the user) are responsible for updating PHP on your own droplets or servers to a patched", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.bbc.com/news/articles/c3qjnwye0ep5o" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "docker-official-image-php-docker-inc-docker-library", "company": "Docker Official Image php (Docker, Inc. / docker-library)", "canonical_domain": "docker.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://github.com/docker-library/php/pull/1694", "statement_date": "Oct 21, 2026 (opened and merged)", "status": "patched", "fixed_version_named": "yes: official php images updated to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://github.com/docker-library/php/pull/1694", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Docker Official Image php and its CLI, FPM, Apache and ZTS variants listed Fix citing this PR, versions.json and official-images PR 22541)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Merged pull request \"[security] Update to 8.5.12, 8.4.27, 8.3.36, 8.2.35\" (#1694) in the official docker-library/php repository, opened by contributor jnoordsij and merged by maintainer LaurentGoderre on 21 Oct 2026; the PR body links the PHP advisory (\"See also https://www.php.net/archive/2026.php#2026-10-21-5.\") and names no CVE itself. Deployed image tags and digests must still be pulled by users; the Docker Hub page was not read in this run.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dolibarr", "company": "Dolibarr", "canonical_domain": "dolibarr.org", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.dolibarr.org/ (no PHP2Shell content)", "https://www.dolibarr.org/news (404)", "https://www.dolibarr.org/blog (404)", "https://www.dolibarr.org/forum/latest (thread \"PHP updates in less than 2 hours: Upcoming Critical PHP Security Release\" opened by community member MarcLaporte, not a maintainer)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Dolibarr ERP CRM listed Vulnerable citing release table only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Dolibarr project statement on PHP2Shell found as of the last check; the only forum thread on the PHP release was opened by a community member and no maintainer (eldy) post appears in the listing. NCSC-NL inventory lists Dolibarr ERP CRM as Vulnerable on the basis of PHP requirements, not a project statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dominion-dms", "company": "Dominion DMS", "canonical_domain": "dominiondms.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.dominiondms.com/", "https://www.dominiondms.com/security/", "https://www.dominiondms.com/blog/" ], "last_checked_utc": "2026-10-23T01:11:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. OverVUE security page describes hosting, encryption, MFA and SOC/ISO status with no PHP mention; blog newest post 03/05/2026; no status or news page link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "doorloop", "company": "DoorLoop", "canonical_domain": "doorloop.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:DoorLoop PHP2Shell", "https://www.doorloop.com/ (homepage, links security, status doorloop.statuspage.io, blog and press, no notice)", "https://www.doorloop.com/security (security page, no PHP or CVE mention)", "https://status.doorloop.com/ (status page)" ], "last_checked_utc": "2026-10-23T02:11:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for Oct 20, 21 and 22, 2026 and \"No incidents reported today.\" for Oct 23, 2026, all components \"All Systems Operational\", quoted from https://status.doorloop.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dreamhost", "company": "DreamHost", "canonical_domain": "dreamhost.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.dreamhoststatus.com/pages/incident/575f0f606826303142000510/6ad8c218a7031204d4ca2981", "statement_date": "October 22, 2026 4:24AM PDT (latest, MONITORING; first October 21, 2026 6:46AM PDT)", "status": "patching", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://www.dreamhoststatus.com/ (incident read from homepage)", "https://www.dreamhoststatus.com/pages/incident/575f0f606826303142000510/6ad8c218a7031204d4ca2981 (direct fetch failed, robots_disallowed)", "search:DreamHost PHP2Shell", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:35:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "completed the deployment of the official PHP security fixes across a large portion of our hosting infrastructure", "notes": "\"completed the deployment of the official PHP security fixes across a large portion of our hosting infrastructure\" (October 21, 2026 10:59PM PDT) and \"we will send out a notification upon final rollout completion\" (October 22, 2026 4:24AM PDT) quoted from https://www.dreamhoststatus.com/ (incident: PHP Security Vulnerability: Protections Are In Place; DreamHost's status site). Affected products listed: Web Hosting, Managed VPS Hosting, DreamPress Hosting, Dedicated Server Hosting. WAF blocking exploit attempts; no customer action required. PHP 8.1 and older: \"Security fixes for these versions, provided under our PHP Extended Support program, are being built\" (October 21, 2026 1:43PM PDT).", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is DreamHost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—DreamHost treated its PHP hosting infrastructure as affected, and says patching is complete. As of October 23, 2026, its latest official update reports that PHP security updates have been deployed across its entire network. The incident covers shared hosting, Managed VPS, DreamPress, and dedicated hosting. DreamHost’s timeline: October 21: Protections were in place, followed by rollout of the official", "cited_urls": [ "https://www.dreamhoststatus.com/pages/incident/575f0f606826303142000510/6ad8c218a7031204d4ca2981" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is DreamHost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on my thorough search of available sources, I found extensive information about PHP2Shell (CVE-2026-109618 and CVE-2026-109619), but no public statement, advisory, blog post, or announcement from DreamHost specifically addressing these vulnerabilities has appeared in any search results. Here is a full breakdown of what is known: ⚠️ DreamHost — No Public Statement Found There is no publicly available", "cited_urls": [ "https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://en.wikipedia.org/wiki/PHP2Shell", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/" ], "names_status": true, "status_named": "no public statement located", "matches_statement": false, "cites_company_page": false, "says_no_statement": true, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is DreamHost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—DreamHost was affected because its servers run PHP, and PHP2Shell affected all PHP installations serving web requests. DreamHost reportedly said it was rolling out PHP’s fix across all servers, while blocking known attack paths in the interim, as of October 21, 2026. The available report does not confirm that the rollout was fully completed; it says only that deployment", "cited_urls": [ "https://tjrobertson.com/php-security-update-wordpress/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/NCSC-NL/php2shell", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://en.wikipedia.org/wiki/PHP2Shell", "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "https://github.com/NCSC-NL/php2shell/blob/main/README.md" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is DreamHost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "DreamHost is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the provider is actively rolling out fixes across its network while deploying temporary firewall protections. Affected Status: DreamHost servers and shared hosting environments initially ran unpatched PHP runtimes. Patch Progress: DreamHost reported that the fixed PHP builds were rolling out to the bulk of its network, with final", "cited_urls": [ "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/", "https://meowapps.com/php2shell-wordpress/", "https://www.reddit.com/r/dreamhost/comments/1xbrnzy/what_is_the_dreamhost_doing_about_the_recent_php/", "https://mjtsai.com/blog/2026/10/21/php2shell/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is DreamHost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, DreamHost's hosting infrastructure was potentially exposed because the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affect the core PHP engine runtime itself rather than a specific web application. DreamHost's Status & Patching Mitigation & WAF Protection: DreamHost's Operations and Technical teams deployed immediate mitigations across all hosting platforms (Shared, VPS, DreamPress, and Dedicated). Their Web Application Firewall (WAF) was configured", "cited_urls": [ "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.reddit.com/r/dreamhost/comments/1xbrnzy/what_is_the_dreamhost_doing_about_the_recent_php/", "https://www.reddit.com/r/dreamhost/comments/1xbrnzy/what_is_the_dreamhost_doing_about_the_recent_php/?tl=it", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null } ] }, { "slug": "drupal", "company": "Drupal", "canonical_domain": "drupal.org", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://www.drupal.org/psa-2026-10-20", "statement_date": "2026-October-21 (published 2026-10-21T03:30:59+00:00, last modified 2026-10-21T16:08:15+00:00)", "status": "customer must update", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://www.drupal.org/security", "https://www.drupal.org/security/psa", "https://www.drupal.org/psa-2026-10-20", "search:Drupal PHP2Shell (no relevant result)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Drupal listed Vulnerable citing requirement docs and releases)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "PSA-2026-10-20 \"Critical PHP update on Wednesday, October 21, 2026 (14:00 UTC)\": \"If you manage PHP yourself, you'll need to apply the update.\" and \"Updating to a PHP release containing the patch to these vulnerabilities is the only complete mitigation.\" quoted from https://www.drupal.org/psa-2026-10-20. Hosted sites told to follow their host's communications. No CVE IDs, no PHP versions, no Drupal core update discussed; Security Team remit limited to code hosted on Drupal.org.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Drupal affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Drupal sites running vulnerable PHP are affected, and fixes are available in PHP, not as a Drupal-core patch. As of October 23, 2026: Affected: Researchers demonstrated unauthenticated remote code execution against Drupal. CVE-2026-109618 and CVE-2026-109619 are vulnerabilities in the underlying PHP runtime, rather than Drupal’s application code. Drupal’s response: Its official PSA-2026-10-20 directs administrators or hosting providers to update", "cited_urls": [ "https://www.php2shell.com/", "https://www.drupal.org/psa-2026-10-20", "https://www.php.net/index.php" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Drupal affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Drupal is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), but the fix comes from patching PHP itself, not Drupal. Here is a detailed breakdown: ⚠️ What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP. Both are rated CVSS v4.0 9.2. Both allow unauthenticated remote code execution on default configurations. The two", "cited_urls": [ "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://sansec.io/research/php2shell", "https://www.upwind.io/feed/initial-assessment-php2shell-two-critical-unpatched-php-rces-cve-2026-109618-cve-2026-109619", "https://vercel.com/kb/bulletin/php2shell-security-bulletin", "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation", "https://www.technology.org/2026/10/22/php2shell-critical-php-rce-cve-2026-109618-109619-patch/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://github.com/Anton-Barinov/php2shell-patches" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Drupal affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Drupal sites are affected when they run a vulnerable PHP runtime—the flaws are in PHP itself, not Drupal core. Researchers demonstrated unauthenticated remote-code execution against current Drupal images, and Drupal’s own statement says updating Drupal alone is insufficient. Has Drupal patched it? Not in Drupal core. The required fix is to update the underlying PHP installation to a", "cited_urls": [ "https://php2shell.eu/", "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.digitalapplied.com/blog/php2shell-critical-php-vulnerabilities-patch-now", "https://www.scottharvanek.com/2026/10/", "https://sansec.io/research/php2shell", "https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/", "https://www.rescana.com/post/php-rce-flaws-patch-october-2026-prepare-now", "https://sra.io/wp-content/uploads/2026/10/TB20261021-PHP2Shell.pdf", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:33.102Z", "question": "Is Drupal affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Drupal sites are affected if they run on an unpatched PHP runtime, because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability in the PHP core engine itself rather than Drupal's application code. Key Details Affected Status: Any Drupal site running on a vulnerable version of PHP can be targeted for unauthenticated remote code execution (RCE) or memory disclosure. The", "cited_urls": [ "https://www.sweet.security/blog/php2shell-critical-php-vulnerabilities-expose-millions-of-applications-to-remote-code-execution", "https://www.drupal.org/association/blog/after-the-php-security-release-auditing-your-drupal-sites", "https://vercel.com/kb/bulletin/php2shell-security-bulletin", "https://www.wiz.io/blog/php2shell-php-rce", "https://securityscorecard.com/blog/php2shell-customer-advisory-cve-2026-109618-and-cve-2026-109619-remediation-guide/", "https://www.drupal.org/psa-2026-10-20" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Drupal affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Drupal sites are affected by PHP2Shell, but because these vulnerabilities (CVE-2026-109618 and CVE-2026-109619) exist within the underlying PHP core engine itself rather than inside Drupal’s application code, Drupal cannot issue an internal software patch to fix them. Security researchers confirmed that unauthenticated remote code execution attacks via PHP2Shell are possible against servers running Drupal 11.4 (as well as", "cited_urls": [ "https://sansec.io/research/php2shell", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://www.picussecurity.com/resource/php2shell-the-two-critical-php-rce-flaws-cve-2026-109618-cve-2026-109619-explained", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "dsn", "company": "DSN", "canonical_domain": "dsn.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.dsn.com/", "https://www.dsn.com/security-and-compliance/", "https://www.dsn.com/category/press/" ], "last_checked_utc": "2026-10-23T01:21:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Security and compliance page has no PHP mention; press newest item September 9, 2025; no status page link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dx1", "company": "DX1", "canonical_domain": "dx1app.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.dx1app.com/", "https://www.dx1app.com/website/website-security (marketing page about dealer website SSL)", "https://www.dx1app.com/blog (fetch failed, client error)", "https://www.dx1app.com/resources/blog" ], "last_checked_utc": "2026-10-23T01:07:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Blog newest post March 24, 2026; no status, trust or news page link in site navigation.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "dyad", "company": "Dyad", "canonical_domain": "dyadtech.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Dyad dyadtech PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.dyadtech.com/ (homepage", "no security or status link)", "https://dyadtech.com/news-insights/ (newest item September 28, 2026)", "https://dyadtech.com/security/ (fetch failed, client error)", "https://status.dyadtech.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "e2open", "company": "e2open", "canonical_domain": "e2open.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:e2open PHP2Shell CVE-2026-109618", "https://www.e2open.com/trust-center/ (fetch failed)", "https://www.e2open.com/", "https://www.e2open.com/customer-security-policy/", "https://www.e2open.com/news/", "https://www.e2open.com/blog/" ], "last_checked_utc": "2026-10-23T00:21:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Customer Security Policy page (last reviewed 4 October 2024) has no advisories; no trust center or status page found. Newest blog post 22 October 2026 is about channel partner performance. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "eaglesoft", "company": "Eaglesoft", "canonical_domain": "eaglesoft.net", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.eaglesoft.net/ (fetch failed, robots disallowed)", "https://www.pattersondental.com/", "https://www.pattersondental.com/software/eaglesoft (fetch failed, client error)", "https://www.pattersondental.com/software", "https://www.offthecusp.com/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. eaglesoft.net disallows automated page reads; parent Patterson Dental pages and its Off the Cusp blog (newest post October 16, 2026) have no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ebix-smartoffice", "company": "Ebix (SmartOffice)", "canonical_domain": "ebix.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Ebix SmartOffice PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.ebix.com/ (homepage", "no security, trust or status link)", "https://www.ebix.com/insights/ (articles undated, none on PHP)", "https://www.ebix.com/news-and-media/ (items undated, none on PHP)", "https://www.ebix.com/security/ (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "entrata", "company": "Entrata", "canonical_domain": "entrata.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Entrata PHP2Shell", "search:Entrata PHP2Shell CVE-2026-109618", "https://www.entrata.com/security (fetch failed)", "https://legal.entrata.com/security", "https://www.entrata.com/blog", "https://www.entrata.com/press", "https://status.entrata.com/" ], "last_checked_utc": "2026-10-23T00:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Security page (legal.entrata.com/security) is a vulnerability-reporting page with no advisories. Status page shows no incidents reported 20, 21 and 22 October 2026. Newest blog post 20 October 2026 is about multifamily expenses; newest press item 6 October 2026. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "erad", "company": "eRAD", "canonical_domain": "erad.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:eRAD PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.erad.com/ (fetch failed: robots_disallowed)", "https://erad.com/", "https://erad.com/news/erad-news/ (newest post August 9, 2022)", "https://erad.com/services/support/" ], "last_checked_utc": "2026-10-23T01:40:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Site banner states \"eRAD is now DeepHealth\". News archive last updated 2022 (it does carry older security statements on Heartbleed, 2014, and WannaCry, 2017). No security, trust or status page linked.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "esub", "company": "eSUB", "canonical_domain": "esub.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:eSUB PHP2Shell", "https://esub.com/security/ (fetch failed, client error)", "https://esub.com/", "https://esub.com/blog/" ], "last_checked_utc": "2026-10-23T00:26:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status link in site navigation; blog newest post Oct 20, 2026 is a product tour, no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "everlogic", "company": "EverLogic", "canonical_domain": "everlogic.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.everlogic.com/", "https://blog.everlogic.com/", "https://everlogic.com/support/" ], "last_checked_utc": "2026-10-23T01:06:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust, status or news link in site navigation; blog listing undated with no security post; support page has no security notice.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "eviivo", "company": "eviivo", "canonical_domain": "eviivo.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:eviivo PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.eviivo.com/ (homepage", "no security, trust or status link)", "https://eviivo.com/blog/ (newest post 25 September 2026)", "https://eviivo.com/blog/?_evi_blog_category=press-coverage (newest item 25 September 2026)", "https://eviivo.com/security/ (fetch failed, client error)", "https://status.eviivo.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ezlynx", "company": "EZLynx", "canonical_domain": "ezlynx.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:EZLynx PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.ezlynx.com/ (homepage)", "https://www.ezlynx.com/security/ (security page", "CSA STAR, SOC 3, responsible disclosure form", "no PHP or CVE mention)", "https://www.ezlynx.com/news/press-releases/ (newest item July 15, 2026)", "https://www.ezlynx.com/products/whats-new/ (newest items September 2026)", "https://status.ezlynx.com/ (undated maintenance notice page, no PHP mention", "linked status page not opened)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "EZLynx is an Applied Systems company. status.ezlynx.com shows an undated maintenance notice only.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ezyvet", "company": "ezyVet", "canonical_domain": "ezyvet.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.ezyvet.com/", "https://status.ezyvet.com/ (redirects to https://status.idexxsoftware.com/)", "https://status.idexxsoftware.com/", "https://www.ezyvet.com/blog", "https://support.ezyvet.com/support/home" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. ezyVet is an IDEXX product; its status page redirects to status.idexxsoftware.com (DVMInsight maintenance 21 October 2026, no PHP mention). No security or trust page on ezyvet.com; newest blog post 15 September 2026; support home has no notices. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "f5", "company": "F5", "canonical_domain": "f5.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://my.f5.com/manage/s/article/K000163821 (fetch failed: page requires JavaScript, only a CSS error loaded)", "https://cdn.f5.com/product/bugtracker/ID1270257.html (bug for CVE-2023-0662, no PHP2Shell content)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (F5 BIG-IP TMOS and BIG-IP APM listed Investigation citing K000163821)", "fetch limit, retry next hour (F5 security advisory listing not yet checked)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "The F5 article K000163821 that NCSC-NL cites could not be read in this run (JavaScript-only page), so no statement is confirmed here. Reported by NCSC-NL inventory (status update 23 Oct 2026): K000163821 lists BIG-IP (all modules) 21.x and 17.x under investigation for CVE-2026-109618 and CVE-2026-109619, confirmation of vulnerability not yet available. Unverified until the F5 page is read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "fastly", "company": "Fastly", "canonical_domain": "fastly.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618", "statement_date": "October 21, 2026", "status": "mitigation only", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.fastlystatus.com/ (no PHP incident)", "https://www.fastly.com/blog/", "https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618", "https://www.fastly.com/security-advisories (lists the PHP posts)", "search:Fastly PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Fastly customers may enable the signal covering both CVE-2026-109618 & CVE-2026-109619.", "notes": "\"Fastly customers may enable the signal covering both CVE-2026-109618 & CVE-2026-109619.\" (Next-Gen WAF virtual patch, opt-in) and \"Apply the patches quickly, and be aware that the patches reflect only the bugs found and exploited to date.\" quoted from https://www.fastly.com/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618 (author Kelly Shortridge, Chief Product Officer). \"the patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35.\"; \"Versions under 7.4 will not receive a patch from PHP.\" The post does not say whether Fastly's own services run PHP. Second post of October 21, 2026: https://www.fastly.com/blog/critical-rce-vulnerabilities-discovered-core-php-cve-2026-109618-cve-2026-109619 (not read in full).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "fics", "company": "FICS", "canonical_domain": "fics.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:FICS fics.com PHP2Shell", "https://www.fics.com/", "https://www.fics.com/in-the-news/press-releases/ (newest October 20, 2026)", "https://www.fics.com/in-the-news/press-releases/fics-introduces-loanlogix-iq-intelligence-software-to-simplify-the-mortgage-loan-approval-process-in-loan-producer/ (dated Oct 20, 2026, no PHP content)", "https://www.fics.com/in-the-news/blog/ (newest February 27, 2025)", "https://www.fics.com/support/" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "fieldedge", "company": "FieldEdge", "canonical_domain": "fieldedge.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://fieldedge.com/", "https://fieldedge.com/news/", "https://fieldedge.com/blog/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust or status link in site navigation (privacy links point to parent Xplor Technologies); news newest item October 20, 2026 (Ply integration); blog newest post September 17, 2026.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "fieldpulse", "company": "FieldPulse", "canonical_domain": "fieldpulse.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:FieldPulse PHP2Shell", "https://www.fieldpulse.com/ (homepage", "footer has no security or status link)", "https://www.fieldpulse.com/resources/blog (blog, posts undated, none on PHP)", "https://www.fieldpulse.com/security (fetch failed, client error)", "https://status.fieldpulse.com/ (status page)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for Oct 20 and Oct 21, 2026 and \"No incidents reported today.\" for Oct 22, 2026, quoted from https://status.fieldpulse.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "fieldwire", "company": "Fieldwire", "canonical_domain": "fieldwire.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Fieldwire PHP2Shell", "https://www.fieldwire.com/security/ (fetch failed, client error)", "https://www.fieldwire.com/", "https://www.fieldwire.com/trust-and-security/", "https://www.fieldwire.com/blog/", "https://status.fieldwire.com/", "https://www.fieldwire.com/press/" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trust and Security page has no PHP mention; status page shows no incidents 20 to 22 Oct 2026; blog newest post October 20, 2026 is a software roundup; press newest item July 2026.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "filevine", "company": "Filevine", "canonical_domain": "filevine.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Filevine PHP2Shell", "https://www.filevine.com/security/ (security page, no PHP or CVE mention, trust link is the FedRAMP trust center at trust.paramify.com/filevine)", "https://status.filevine.com/ (302 redirect to a support article, https://support.filevine.com/hc/en-us/articles/8671232852507-Status-Page, not fetched)", "https://www.filevine.com/news/ (newest item 1 September, 2026, none on PHP)" ], "last_checked_utc": "2026-10-23T02:04:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No PHP2Shell item on the security page or newsroom; status.filevine.com redirects to a help-center article rather than a live status page.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "finastra", "company": "Finastra", "canonical_domain": "finastra.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Finastra PHP2Shell", "https://www.finastra.com/", "https://www.finastra.com/security (fetch failed: client_error)", "https://www.finastra.com/press-media (newest item 21 Oct 2026)", "https://www.finastra.com/press-media/brac-bank-enhances-trade-finance-operations-finastra (dated October 21, 2026, no PHP content)", "https://www.finastra.com/support/customer-support" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page linked from the homepage or support page. Newest press release (21 October 2026) is a customer announcement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "firefly-iii", "company": "Firefly III", "canonical_domain": "firefly-iii.org", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://github.com/firefly-iii/firefly-iii/issues/13087", "statement_date": "Oct 21, 2026 (issue opened and closed the same day)", "status": "patched", "fixed_version_named": "yes: Firefly III and data importer Docker containers rebuilt on PHP 8.5.12 (no new release number)", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://github.com/firefly-iii/firefly-iii/issues/13087", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Firefly III listed Fix citing this issue comment)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Issue \"[PHP] CVE-2026-109618 & CVE-2026-109619\" on the project's official GitHub repository; maintainer JC5 (James Cole), 21 Oct 2026: \"This will not result in a new release, the existing containers will be rebuilt.\" and \"Firefly III and the data importer are all running the latest version of PHP, 8.5.12.\" quoted from the issue URL; issue closed as resolved. Users of the Docker images need to pull the rebuilt containers; no explicit instruction for non-Docker installs was given on the page.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "floify", "company": "Floify", "canonical_domain": "floify.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Floify PHP2Shell", "https://floify.com/", "https://floify.com/press-room (newest item April 1, 2026)", "https://floify.com/blog (mostly undated, newest dated post July 11, 2025)", "https://status.floify.com/ (6 to 22 October 2026 read)" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows scheduled maintenance completed 20 October 2026 and \"No incidents reported\" for 21 and 22 October; it says \"Release notes will be posted on help.floify.com after the release.\" (quoted from https://status.floify.com/). No PHP or CVE mention. No security or trust page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "flywheel", "company": "Flywheel", "canonical_domain": "getflywheel.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://status.getflywheel.com/2026/10/21/php-security-update/", "statement_date": "October 21, 2026, Posted at 9:31 am; final update Updated on 2026-10-21 02:00 pm (RESOLVED)", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "status page", "places_checked": [ "https://status.getflywheel.com/2026/10/21/php-security-update/ (robots-disallowed for the fetcher", "read in a browser)", "https://status.getflywheel.com/feed/ (robots-disallowed)", "search:Flywheel getflywheel PHP security update October 2026", "search:site:getflywheel.com PHP2Shell OR CVE-2026-109618", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:36:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on the Flywheel platform. The patch has been applied to your PHP version, and no action is needed from you.", "notes": "\"WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on the Flywheel platform. The patch has been applied to your PHP version, and no action is needed from you.\" (Updated on 2026-10-21 02:00 pm) quoted from https://status.getflywheel.com/2026/10/21/php-security-update/ (incident: PHP Security Update, RESOLVED; Flywheel is a WP Engine brand). Earlier: \"We are currently deploying patches for the Flywheel platform.\" (2026-10-21 12:30 pm) with protective mitigations at the CDN layer (Cloudflare and Fastly) and host layer. No fixed PHP build named.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Flywheel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Flywheel reports that it has patched its hosting platform. As of October 23, 2026, its official “PHP Security Update” incident is marked Resolved. The completion update, posted October 21, 2026, at 2:00 p.m., states: > “WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on the Flywheel platform.” Flywheel says the patch was applied", "cited_urls": [ "https://status.getflywheel.com/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Flywheel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes — Flywheel is affected by PHP2Shell, but it has been fully patched. Here is a detailed breakdown: What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code on a web server without logging in. The PHP security team rates both CVSSv4.0 9.2 and", "cited_urls": [ "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://meowapps.com/php2shell-wordpress/", "https://www.activeset.co/blog/php2shell-host-status", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://en.wikipedia.org/wiki/PHP2Shell" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Flywheel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Flywheel is potentially affected if its hosting stack was running an unpatched PHP version. PHP2Shell affects PHP itself, so applications and hosting platforms using PHP are in scope regardless of the CMS or framework. However, no source found here confirms that Flywheel specifically was affected, or that Flywheel had completed its patching. The available advisories only establish that affected", "cited_urls": [ "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/hkoeck/php2shell-status", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md", "https://en.wikipedia.org/wiki/PHP2Shell", "https://sansec.io/research/php2shell", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Flywheel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, sites running on Flywheel (owned by WP Engine) were affected by the core PHP PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619 ), and the parent platform has deployed fixes and edge-layer protections. Key Details Vulnerability Impact: Because PHP powers the underlying runtime for WordPress sites, unpatched PHP installations on the server level were exposed to unauthenticated remote code execution (RCE)", "cited_urls": [ "https://hackernoon.com/nsa-says-patch-or-go-offline-as-ai-found-php2shell-flaws-reach-70percent-of-the-web", "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/", "https://www.upistudy.com/blog/cybersecurity/wp2shell-vs-php2shell-two-2026-web-security-stories-explained-side-by-side", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers", "https://www.servicenow.com/community/armis-articles/php2shell-how-to-find-prioritize-and-patch-affected-systems/ta-p/3612792" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Flywheel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Flywheel (as a managed WordPress hosting platform running PHP environments) is inherently exposed to core PHP vulnerabilities like PHP2Shell (CVE-2026-109618 and CVE-2026-109619) because these critical remote code execution flaws exist within the PHP interpreter engine itself. Are you affected / Has it patched? Flywheel implemented initial protective measures at the CDN and infrastructure edge/firewall level immediately following the", "cited_urls": [ "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell", "https://dev.to/cseeman/patch-your-php-what-php2shell-means-for-wordpress-sites-2akn", "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/", "https://meowapps.com/php2shell-wordpress/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "fortinet", "company": "Fortinet", "canonical_domain": "fortinet.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-186", "statement_date": "Oct 21, 2026 (Updated Oct 22, 2026)", "status": "not affected", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://fortiguard.fortinet.com/psirt/FG-IR-26-186", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (FortiADC, FortiADC Manager, FortiClient Cloud Services, FortiDDoS, FortiDDoS-F, FortiEndpoint, FortiMonitor, FortiSIEM listed Investigation citing FG-IR-26-186)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "FG-IR-26-186 \"PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)\", severity Critical. Mixed: confirmed not impacted list includes FortiOS, FortiProxy, FortiWeb, FortiManager, FortiAnalyzer, FortiClient EMS, FortiMail, FortiSASE, FortiAuthenticator, FortiSwitch, FortiNAC and more; still under investigation: FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR, FortiSOAR PaaS. \"Fortinet is currently investigating the impact of these CVEs over Fortinet Products.\" quoted from https://fortiguard.fortinet.com/psirt/FG-IR-26-186. No fixed versions listed; IPS signatures released in version 37.316; known exploited: No.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Fortinet affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "If you mean FortiGate/FortiOS: no—Fortinet explicitly says FortiOS is not affected by CVE-2026-109618 or CVE-2026-109619. That is different from saying every Fortinet product is unaffected. As checked on October 23, 2026: | Question | Verified answer | |---|---| | Is FortiGate/FortiOS affected? | No, according to Fortinet’s official technical article. | | Has Fortinet released protection? | Yes. FortiGate", "cited_urls": [ "https://community.fortinet.com/fortigate-3/using-the-fortigate-to-protect-against-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-230762?utm_source=openai", "https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750" ], "names_status": true, "status_named": "not affected", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Fortinet affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of Fortinet's status regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619), based on the latest available sources: 🔒 PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — Fortinet's Status What is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell, are two Remote Code Execution vulnerabilities in PHP. Both are rated CVSS v4.0 9.2. Both allow an unauthenticated attacker to execute their", "cited_urls": [ "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://fortiguard.fortinet.com/psirt/FG-IR-26-186", "https://www.fortiguard.com/psirt/FG-IR-26-186", "https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/", "https://www.fortiguard.com/threat-signal-report/6551/php2shell-remote-code-execution-vulnerabilities", "https://fortiguard.fortinet.com/threat-signal-report/6551" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Fortinet affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Fortinet’s current position is that FortiOS/FortiGate and several other named products are not affected, while 12 products remain under investigation. Fortinet has not confirmed that any of those products are vulnerable or issued product-specific patches yet. Confirmed not impacted: FortiOS/FortiGate FortiManager FortiAnalyzer FortiWeb FortiMail FortiClient for Linux, Windows, and macOS FortiSASE FortiAuthenticator FortiSwitch FortiNAC Still under investigation: FortiADC and", "cited_urls": [ "https://community.fortinet.com/support-forum-92/critical-vulnerabilities-in-php-cve-2026-109618-and-cve-2026-109619-230731", "https://blog.boll.ch/php2shell-vulnerability-cve-2026-109618-and-cve-2026-109619/", "https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750", "https://threatcluster.io/cluster/php2shell-vulnerabilities-impact-fortinet-cisco-and-palo-alt-f7e3532d", "https://blog.rankiteo.com/palforcis1792672003-fortinet-cisco-palo-alto-networks-vulnerability-october-2026/", "https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/", "https://github.com/ersinkoc/php-fix", "https://github.com/NCSC-NL/php2shell", "https://github.com/hkoeck/php2shell-status", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:18:09.009Z", "question": "Is Fortinet affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Fortinet’s core products—including FortiOS (running on FortiGate firewalls), FortiManager, FortiAnalyzer, FortiWeb, and FortiMail—are not impacted by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). However, Fortinet is currently investigating 12 specific products to evaluate potential exposure: FortiADC, FortiADC Manager, FortiClient EMS, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard, and FortiEndpoint. For protection and remediation: Patching Status: Because these", "cited_urls": [ "https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/", "https://fortiguard.fortinet.com/threat-signal-report/6551", "https://community.fortinet.com/fortigate-3/using-the-fortigate-to-protect-against-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-230762", "https://fortiguard.fortinet.com/psirt/FG-IR-26-186" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Fortinet affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on official Fortinet advisories and documentation: Impact Status: Fortinet's core products (such as FortiOS) are not impacted by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because FortiOS itself does not use the affected PHP implementations. Mitigation / Protection: Because Fortinet products are not vulnerable, no product-specific software patch is required for FortiOS. However, Fortinet has released official IPS (Intrusion", "cited_urls": [ "https://community.fortinet.com/fortigate-3/using-the-fortigate-to-protect-against-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-230762", "https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750", "https://fortiguard.fortinet.com/threat-signal-report/6551", "https://fortiguard.fortinet.com/psirt/FG-IR-26-186" ], "names_status": true, "status_named": "not affected", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null } ] }, { "slug": "foundation-software", "company": "Foundation Software", "canonical_domain": "foundationsoft.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Foundation Software PHP2Shell", "https://www.foundationsoft.com/", "https://www.foundationsoft.com/press-releases/" ], "last_checked_utc": "2026-10-23T00:29:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust, status or blog link in site navigation; press releases newest August 25, 2026. Search results for this name return PHP Foundation articles, not this company.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "frankenphp", "company": "FrankenPHP", "canonical_domain": "frankenphp.dev", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://github.com/php/frankenphp/releases", "statement_date": "21 Oct (release v1.13.2; year not printed in the release block)", "status": "patched", "fixed_version_named": "yes: FrankenPHP v1.13.2 built with PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://github.com/php/frankenphp/releases", "https://github.com/php/frankenphp/issues/2732", "https://frankenphp.dev/ (no notice on the home page)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (FrankenPHP static builds listed Vulnerable, fixed artifact release not yet confirmed at its last update)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Release notes v1.13.2 on the project's official GitHub repository (php/frankenphp), a security release: \"Docker images are built with PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12\" fixing CVE-2026-109618 and CVE-2026-109619; \"Upgrading is strongly recommended.\" Both quoted from https://github.com/php/frankenphp/releases. Static builds now use static-php-cli v3. Issue #2732 (opened 20 Oct 2026) tracked the request for rebuilt images; no maintainer comment was shown in the snapshot read. The frankenphp.dev home page carries no notice.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "frazer", "company": "Frazer", "canonical_domain": "frazer.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.frazer.com/", "https://www.frazer.com/resources (listings did not render)", "https://www.frazer.com/blog (listings did not render)", "https://www.frazer.com/frazer-support" ], "last_checked_utc": "2026-10-23T01:06:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust, status or news link in site navigation; resources and blog listings load dynamically and did not render; support page has no security notice.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "freepbx", "company": "FreePBX", "canonical_domain": "freepbx.org", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://community.freepbx.org/c/announcements/5 (fetch failed at first try)", "https://community.freepbx.org/latest", "https://community.freepbx.org/t/php-cve-patching/110401 (community thread, 38 replies, no post marked as Sangoma staff)", "https://community.freepbx.org/t/time-to-say-good-bye-to-v16-and-older-major-php-zero-day-flaw/110404 (listing only)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (FreePBX 17 management framework and Sangoma PBXact 17 listed Investigation citing wiki and installer only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Sangoma or FreePBX project statement on PHP2Shell found as of the last check. The community thread \"PHP CVE Patching\" (opened 21 Oct 2026) carries an explicitly unofficial mitigation guide; one poster wrote \"this fix is not an official Sangoma-endorsed patch.\" (kierknoby, 21 Oct 2026, quoted from https://community.freepbx.org/t/php-cve-patching/110401). A user question on whether FreePBX 16 (PHP 7.4) will get an update had no Sangoma reply on the page read. NCSC-NL inventory lists FreePBX 17 and PBXact 17 as Investigation.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "freightpop", "company": "FreightPOP", "canonical_domain": "freightpop.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.freightpop.com/", "https://www.freightpop.com/security", "https://blog.freightpop.com", "https://www.freightpop.com/in-the-news" ], "last_checked_utc": "2026-10-23T01:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. Security page describes SOC 2 Type II (audit 21 May 2026), encryption and AWS hosting, no advisories; no status page found. Newest blog post 21 October 2026 is about NetSuite freight cost. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "freshsales", "company": "Freshsales", "canonical_domain": "freshworks.com", "group": "index_vendor", "index_category": "crm", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Freshworks PHP2Shell", "https://www.freshworks.com/security/ (security page, no PHP or advisory mention)", "https://trust.freshworks.com/ (trust center, no updates section, no PHP mention)", "https://status.freshworks.com/ (status app, no incident text in the fetch)", "https://www.performio.de/freshworks-nicht-von-php-sicherheitsluecke-betroffen/ (third party, performio GmbH)" ], "last_checked_utc": "2026-10-23T02:03:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Reported by performio (Anna-Lena Richert) 22/10/2026: \"sind die von Freshworks betriebenen SaaS-Lösungen von diesen PHP-Sicherheitslücken nicht betroffen\" (Freshworks-operated SaaS not affected), attributed to \"Angaben des Herstellers Freshworks\" with no link to a Freshworks page. No Freshworks statement found on its own domain.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "fujifilm-synapse", "company": "Fujifilm (Synapse)", "canonical_domain": "fujifilm.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Fujifilm Synapse PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.fujifilm.com/us/en/healthcare", "https://www.fujifilm.com/us/en/information-security", "https://newsroom-us.fujifilm.com/home/default.aspx (no items rendered)", "https://newsroom-us.fujifilm.com/press-releases/default.aspx (items load dynamically, none rendered)", "https://healthcaresolutions-us.fujifilm.com/ (healthcare unit site", "newest press release October 19, 2026", "links a Security Center)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Corporate information-security page is a generic program statement (footer dated 2018). Healthcare unit press releases (newest 19 October 2026) are product announcements. No status page located.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ge-healthcare", "company": "GE HealthCare", "canonical_domain": "gehealthcare.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:GE HealthCare PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.gehealthcare.com/", "https://www.gehealthcare.com/en-us/productsecurity/products (Product Security Portal", "Products & Patches and Security Notices sections rendered empty on fetch)", "https://www.gehealthcare.com/en-us/about/newsroom (newest October 20, 2026)", "https://www.gehealthcare.com/en-us/about/newsroom/press-releases/ge-healthcare-announces-five-new-global-clinical-collaborations-to-advance-the-next-generation-of-theranostics-imaging (dated October 20, 2026, no PHP content)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Product Security Portal notices could not be read (dynamic content). Newest press release (20 October 2026) concerns theranostics imaging collaborations.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "glovebox", "company": "GloveBox", "canonical_domain": "glovebox.io", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:GloveBox PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.glovebox.io/ (homepage", "script-rendered, only metadata readable)", "https://www.glovebox.io/blog (only metadata readable)", "https://www.glovebox.io/security (page titled \"Data Security and Privacy Overview | GloveBox\"", "body not readable, metadata only)", "https://status.glovebox.io/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Site is script-rendered; no page text beyond metadata could be read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "glpi-teclib", "company": "GLPI (Teclib)", "canonical_domain": "glpi-project.org", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://www.glpi-project.org/en/%f0%9f%9a%a8-critical-php2shell-php-vulnerabilities-cve-2026-109618-cve-2026-109619-what-you-need-to-know-for-your-glpi-server/", "statement_date": "21.10.26", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://glpi-project.org/news/ (newsletter sign-up page only)", "https://www.glpi-project.org/en/blog/", "https://www.glpi-project.org/en/%f0%9f%9a%a8-critical-php2shell-php-vulnerabilities-cve-2026-109618-cve-2026-109619-what-you-need-to-know-for-your-glpi-server/", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (GLPI listed Vulnerable citing prerequisites and release 12.0.0 only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"Critical php2shell PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619): What you need to know for your GLPI server\". Mixed: GLPI Network Cloud patched (\"every GLPI Cloud server is running a patched, secure PHP version.\" as of 14:00 UTC 21 Oct 2026, no customer action, no exploitation detected); self-hosted users: \"The core GLPI codebase does not contain these security flaws.\" and \"You must update the PHP package installed on your host system or application container.\" All quoted from the statement URL. Restart Apache, Nginx or PHP-FPM after updating; pull rebuilt official Docker images (main, 12, 11, 10) and recreate containers; legacy PHP versions will not receive vendor patches. No PHP version numbers named.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "godaddy", "company": "GoDaddy", "canonical_domain": "godaddy.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do", "statement_date": "2026-10-20T21:38:56 (page metadata); timeline updates to October 22, 2026, 01:20 UTC", "status": "patched partly", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "We have patched all PHP versions on Managed Hosting for WordPress.", "notes": "\"We have patched all PHP versions on Managed Hosting for WordPress.\" \"We have patched all PHP versions on Windows Hosting.\" \"We have the patches from our vendor and are deploying them to all Web Hosting servers now.\" quoted from https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do (title: Important PHP security update: What website owners need to do). Web Hosting still deploying at the 22 Oct 01:20 UTC update, with mitigations in place; VPS customers must update PHP themselves or use GoDaddy Expert Services; self-managed: \"restart PHP and your web server so the update takes effect.\" EOL: \"PHP no longer supports these versions and will not release an official fix for them.\" (8.1 and older; upgrade to 8.2+ recommended).", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is GoDaddy affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—GoDaddy’s PHP hosting was affected, but GoDaddy now reports its managed hosting services are patched. Self-managed VPS/server customers must patch PHP themselves. This is the status as of October 23, 2026, based on GoDaddy’s own updates. | GoDaddy service | Reported patch status | |---|---| | Managed Hosting for WordPress | All PHP versions patched; confirmed October 21, 19:30", "cited_urls": [ "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do", "https://godaddy.statuspage.io/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is GoDaddy affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a full breakdown of GoDaddy's exposure to PHP2Shell and its patch status, based on available sources: What Is PHP2Shell? PHP2Shell is the name used for two critical flaws in PHP itself, which CERT-EU names CVE-2026-109618 and CVE-2026-109619. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. CVE-2026-109618 stems from", "cited_urls": [ "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers", "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is GoDaddy affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—GoDaddy was affected in principle, because PHP2Shell affects unpatched PHP installations. However, GoDaddy states that it patched all PHP versions on its Web Hosting and Windows Hosting platforms as of its October 22, 2026 update, and says customers on those services need take no action. The upstream fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Exception: GoDaddy VPS and", "cited_urls": [ "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do", "https://php2shellcheck.com/hosting-status/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell", "https://github.com/hkoeck/php2shell-status", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619", "https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/", "https://en.wikipedia.org/wiki/PHP2Shell" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is GoDaddy affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, GoDaddy is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and its patch status varies depending on the hosting tier: Managed Hosting for WordPress: GoDaddy has patched all PHP versions on this tier. Web Hosting and Windows Hosting: GoDaddy stated it is still waiting for upstream vendor and control panel package releases (such as cPanel backports) to roll", "cited_urls": [ "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://www.reddit.com/r/godaddy/comments/1xcge2t/godaddy_still_running_php_8234_almost_24_hours/", "https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/", "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is GoDaddy affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact: Yes, GoDaddy's hosting environment was exposed to the industry-wide \"PHP2Shell\" vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because they affect the core PHP language runtime across all hosting providers, rather than being specific to GoDaddy. Patch Status: Yes, GoDaddy confirmed that they have rolled out updates and patches across their standard Web Hosting services, Managed WordPress, and Windows Hosting environments following", "cited_urls": [ "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.reddit.com/r/godaddy/comments/1xcge2t/godaddy_still_running_php_8234_almost_24_hours/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "godaddy-india", "company": "GoDaddy India", "canonical_domain": "godaddy.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do", "statement_date": "2026-10-20T21:38:56 (page metadata); timeline updates to October 22, 2026, 01:20 UTC", "status": "patched partly", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.godaddy.com/en-in/ (no banner)", "https://www.godaddy.com/en-in/resources/news (fetch failed, client_error)", "https://www.godaddy.com/en-in/resources/news/important-php-security-update-what-website-owners-need-to-do (fetch failed, client_error)", "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do", "search:GoDaddy India PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:31:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No India-specific page found (the en-in copies of the news article and news index returned client errors); the India site is a locale of godaddy.com, so GoDaddy's global statement applies: \"We have patched all PHP versions on Managed Hosting for WordPress.\" \"We have the patches from our vendor and are deploying them to all Web Hosting servers now.\" quoted from https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do. VPS customers must update PHP themselves; \"restart PHP and your web server so the update takes effect.\"; \"PHP no longer supports these versions and will not release an official fix for them.\" (8.1 and older).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "google-cloud", "company": "Google Cloud", "canonical_domain": "cloud.google.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "statement_date": "October 21, 2026 (bulletin GCP-2026-070 published 2026-10-21)", "status": "patched partly", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://docs.cloud.google.com/support/bulletins (GCP-2026-070)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:35:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "App Engine standard (PHP 8.2+): \"Applications are updated automatically. No action is required.\" App Engine flexible: \"Applications are not updated automatically. Redeploy your application as soon as possible to PHP 8.2 and newer.\" \"Container images you build yourself are your responsibility.\" \"The upstream PHP project is not backporting these fixes to PHP 8.1 or earlier.\" quoted from the blog post (authors Chris Betz, Raluca Ada Popa). Cloud Run / Cloud Run functions updated only where automatic base image updates are enabled; GKE pods must be redeployed. Bulletin GCP-2026-070 at https://docs.cloud.google.com/support/bulletins: \"Google Cloud itself is not vulnerable.\" and \"Some workloads may be automatically patched and updated to the latest PHP.\"", "ai_answer_note": null, "ai_answers": [] }, { "slug": "greengeeks", "company": "GreenGeeks", "canonical_domain": "greengeeks.com", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://status.greengeeks.com/ (shows only a login link, no public incidents)", "https://www.greengeeks.com/blog/ (no PHP post)", "https://www.greengeeks.com/ (no banner", "no status or security page linked)", "search:GreenGeeks PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Nothing found on the status page (login-only), blog or homepage.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "gridpane", "company": "GridPane", "canonical_domain": "gridpane.com", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://gridpane.com/ (no banner)", "https://gridpane.com/blog/ (newest post 27 Apr 2026)", "https://status.gridpane.com/ (fetch failed, robots_disallowed)", "https://roadmap.gridpane.com/f/changelog/ (did not render)", "https://gridpane.com/kb/ (newest article 22 Oct 2026 about database versions, no PHP security article)", "search:GridPane PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:34:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Nothing found on the homepage, blog or knowledge base; status page could not be fetched (robots_disallowed) and the changelog did not render.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "guestline", "company": "Guestline", "canonical_domain": "guestline.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Guestline PHP2Shell", "https://www.guestline.com/ (302 redirect to https://www.theaccessgroup.com/en-gb/our-brands/guestline/)", "https://www.theaccessgroup.com/en-gb/our-brands/guestline/ (brand page, no PHP mention", "no status link)", "https://www.theaccessgroup.com/en-gb/about/news/ (Access Group news, newest dated item 29/07/2026, no PHP or Guestline mention)", "https://www.theaccessgroup.com/en-gb/legal-hub/ (legal hub, no PHP mention, no security advisory or status link)", "https://status.guestline.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Guestline is an Access Group brand; guestline.com redirects to theaccessgroup.com. No Guestline-specific security, trust or status page could be read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "hawksoft", "company": "HawkSoft", "canonical_domain": "hawksoft.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:HawkSoft PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.hawksoft.com/ (homepage)", "https://status.hawksoft.app/ (status page)", "https://blog.hawksoft.com/ (newest posts October 21, 2026, no PHP mention in listing)", "https://blog.hawksoft.com/the-intake-blueprint-a-practical-workflow-for-reducing-rework (October 21 2026 workflow post, no PHP mention", "rechecked 2026-10-23T02:20Z)", "https://www.hawksoft.com/news/ (newest item July 14, 2026)", "https://www.hawksoft.com/security/ (security page with placeholder body text, no PHP mention)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for Oct 20 and Oct 21, 2026 and \"No incidents reported today.\" for Oct 22, 2026, quoted from https://status.hawksoft.app/; the security page body is placeholder text.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "hemlane", "company": "Hemlane", "canonical_domain": "hemlane.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Hemlane PHP2Shell", "https://www.hemlane.com/ (homepage, no security, trust, status or newsroom link, no notice)", "https://www.hemlane.com/resources/blog/ (blog index, no posts rendered in the fetch, no PHP mention)" ], "last_checked_utc": "2026-10-23T02:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from hemlane.com. No PHP2Shell item found.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "hetzner", "company": "Hetzner", "canonical_domain": "hetzner.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7", "statement_date": "2026-10-22 04:32 UTC+0 (latest; start 2026-10-21 11:04 UTC+0)", "status": "patched", "fixed_version_named": "yes: PHP 5.6, 7.3, 7.4, 8.0 to 8.5 (branches only, no point releases)", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "We deployed patches for the PHP versions 7.4 and 8.0-8.5 on all Webhosting- and Managed-Servers.", "notes": "\"We deployed patches for the PHP versions 7.4 and 8.0-8.5 on all Webhosting- and Managed-Servers.\" (2026-10-21 17:50) and \"We deployed patches for the remaining PHP versions 5.6 and 7.3 on all Webhosting- and Managed-Servers.\" (2026-10-22 04:32) quoted from https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7 (title: PHP security issues CVE-2026-109618 and CVE-2026-109619). Covers Webhosting and Managed Servers (also konsoleH, Storage Share, phpMyAdmin, Webmail); dedicated and cloud server customers to be notified by email separately (unmanaged). Status label still Investigating.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Hetzner affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Hetzner confirmed it was affected, and has patched PHP on all its Webhosting and Managed Servers. As of October 23, 2026, its official incident report gives this timeline: | Date/time (UTC) | Confirmed update | |---|---| | October 21, 2026 | Hetzner acknowledged that its PHP versions were affected by both CVEs. | | October 21, 17:50 | Patches", "cited_urls": [ "https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Hetzner affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes — Hetzner was affected by PHP2Shell and has deployed patches. Here is a full breakdown, sourced directly from Hetzner's own status page and other authoritative sources: What is PHP2Shell? PHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). CVE-2026-109618 (CVSS 9.2) stems from how PHP handles out-of-memory", "cited_urls": [ "https://en.wikipedia.org/wiki/PHP2Shell", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Hetzner affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Hetzner was affected, but its current status indicates that patches have been deployed for the PHP versions it supports on its Webhosting and Managed Server platforms. Hetzner initially confirmed that the PHP versions it used were vulnerable to CVE-2026-109618 and CVE-2026-109619. It subsequently reported that patches were deployed for PHP 7.4 and 8.0–8.5, and then for the remaining", "cited_urls": [ "https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7", "https://github.com/NCSC-NL/php2shell", "https://github.com/hkoeck/php2shell-status", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC", "https://en.wikipedia.org/wiki/PHP2Shell", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md", "https://ubuntu.com/blog/php2shell-vulnerability-fixes-available" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is Hetzner affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Hetzner confirmed that the PHP versions it uses are affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619) , and it is actively rolling out patches across its systems. Status & Details Impacted Systems: Hetzner acknowledged that its managed hosting and related services (konsoleH, Managed Servers, Storage Share / Nextcloud, phpMyAdmin, and Webmail) run affected PHP versions. Mitigation & Patching: Hetzner", "cited_urls": [ "https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7", "https://status.hetzner.com/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Hetzner affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact on Hetzner: Yes, Hetzner's managed infrastructure and webhosting environments were initially affected because the PHP versions they use rely on the vulnerable core runtime affected by CVE-2026-109618 and CVE-2026-109619. Patch Status: Yes, Hetzner has patched the issue across their systems. They deployed emergency patches for PHP versions 5.6 and 7.3, as well as versions 7.4 and 8.0–8.5, across", "cited_urls": [ "https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null } ] }, { "slug": "hostgator", "company": "HostGator", "canonical_domain": "hostgator.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.hostgator.com/status/announcement/277", "statement_date": "Posted 21st October, 2026; latest update Oct 22nd 11:00est", "status": "patching", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; cPanel EA4 vendor backports 8.1.34-5, 8.0.30-12, 7.4.33-19; Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://www.hostgator.com/status", "https://www.hostgator.com/status/announcement/277", "search:HostGator PHP2Shell OR CVE-2026-109618", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:38:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Our teams have successfully patched the majority of servers and are completing updates on the remaining systems.", "notes": "\"Our teams have successfully patched the majority of servers and are completing updates on the remaining systems.\" (Oct 21st 23:00est) and \"If you are on a patched version of PHP, no action is needed; we are applying patches for you.\" quoted from https://www.hostgator.com/status/announcement/277 (title: PHP Update). Oct 22nd 11:00est reports \"significant progress\" with no completion notice. VPS/dedicated customers run a package update through their control panel; lists backported builds for 8.1, 8.0, 7.4 and alt-php 5.2 to 7.3 without calling them end-of-life.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is HostGator affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—HostGator has affected PHP infrastructure and has patched most, but has not confirmed that all servers are patched. As of October 23, 2026, its latest official update is October 22 at 18:15 (labeled “est” on its page): deployment continues on remaining infrastructure, with the majority up to date. Its earlier update explicitly identifies CVE-2026-109618 and CVE-2026-109619. Source: HostGator’s official", "cited_urls": [ "https://www.hostgator.com/status/announcement/277" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is HostGator affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on my thorough search of available sources, I was unable to find any public statement, advisory, or announcement specifically from or about HostGator regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619). No security bulletin, blog post, or third-party report mentioning HostGator's specific response to these CVEs appeared in any search results. Here is what is known about the vulnerabilities themselves and", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://sansec.io/research/php2shell", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619", "https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is HostGator affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "HostGator’s status is not publicly confirmed in the available sources. Since PHP2Shell affects the PHP engine itself, HostGator would be affected wherever its shared, reseller, VPS, or dedicated hosting servers run an unpatched PHP version; the vulnerabilities affect PHP installations serving web requests, including PHP-FPM and Apache/mod_php. PHP released fixes on October 21, 2026, in PHP 8.2.35, 8.3.36, 8.4.27,", "cited_urls": [ "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://en.wikipedia.org/wiki/PHP2Shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is HostGator affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "HostGator was affected by the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and HostGator has been rolling out patches across its hosting infrastructure. Status & Details Impact: HostGator's infrastructure runs on PHP environments affected by the core runtime flaws in CVE-2026-109618 and CVE-2026-109619. Patch Status: HostGator stated that its teams have made significant progress deploying patched PHP builds", "cited_urls": [ "https://www.hostgator.com/status/announcement/277", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is HostGator affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact Status: Yes, HostGator's hosting infrastructure utilizing vulnerable PHP builds was affected by the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Patch Status: HostGator's teams have made significant progress and the majority of their shared and managed hosting platforms are now up-to-date with patched PHP builds, while rollout across remaining infrastructure continues. Source: Official updates and deployment tracking", "cited_urls": [ "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://www.hostgator.com/status/announcement/277" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "hostinger", "company": "Hostinger", "canonical_domain": "hostinger.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.hostinger.com/blog/protecting-php2shell/", "statement_date": "Wednesday October 21, 2026; Updated October 22, 07:20 UTC", "status": "patched", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.hostinger.com/blog/protecting-php2shell/", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "we rolled them out across the platform (completed October 22 at 06:44 UTC)", "notes": "\"we rolled them out across the platform (completed October 22 at 06:44 UTC)\" and \"is now installed on all Hostinger hosting servers except VPS\" quoted from https://www.hostinger.com/blog/protecting-php2shell/ (title: Hostinger deploys protections against php2shell PHP vulnerabilities; authors Gediminas G. & Saulius L.). Mixed: every plan except VPS patched by Hostinger; VPS customers must update: \"if you manage PHP on your own server, update it and restart it now.\" Firewall rules in deny mode and session.upload_progress disabled as mitigations. EOL: \"PHP 8.1 and older versions no longer get fixes from the PHP project\" (its managed hosting still covers those sites); PHP 8.2 security fixes end 31 Dec 2026.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Hostinger affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Hostinger says its managed hosting was protected against PHP2Shell and is now patched. VPS is the exception: customers must patch it themselves. As of October 23, 2026: | Hosting type | Affected? | Patch status | |---|---|---| | Managed hosting—Web, Cloud, Agency and cPanel | Hostinger says its environment tests found it was not vulnerable to the circulating exploit;", "cited_urls": [ "https://www.hostinger.com/blog/protecting-php2shell/", "https://statuspage.hostinger.com/incidents/pj2zs1lx3n9d" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Hostinger affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Hostinger is affected by PHP2Shell — but it has responded quickly and comprehensively. Here is a full breakdown: What is PHP2Shell? On October 21, the PHP project fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. Both are rated 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS). CVE-2026-109618 (\"RCE via OOM corruption\"): PHP's", "cited_urls": [ "https://www.hostinger.com/blog/protecting-php2shell/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Hostinger affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Hostinger’s managed hosting was not exploitable by the circulating PHP2Shell exploit according to its own testing, and Hostinger says its firewall rules blocked matching attack requests. It has also completed deployment of PHP’s fix across all managed hosting servers as of October 22, 2026 at 06:44 UTC. Web Hosting, Agency Hosting, and cPanel Hosting: patched; customers do not need", "cited_urls": [ "https://www.hostinger.com/blog/protecting-php2shell/", "https://www.hostinger.com/blog/feed/", "https://php2shellcheck.com/hosting-status/", "https://arvindkumar.ca/blog/php2shell-wordpress/", "https://pulsetic.com/status/hostinger/incidents/151752/", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://mallory.ai/blog/php-rce-rapid-response", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/NCSC-NL/php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Hostinger affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Hostinger stated that its shared and managed hosting environments were not directly vulnerable to the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) due to platform architecture (such as LiteSpeed handling and isolated account permissions), though it has rolled out patched PHP builds across all managed hosting infrastructure . Sources & Status Details Hostinger Status Page & Updates: According to the Hostinger", "cited_urls": [ "https://statuspage.hostinger.com/", "https://www.reddit.com/r/Hostinger/comments/1xbru8x/you_werent_affected_by_the_new_php_vulnerability/", "https://x.com/Hostinger/status/2112943242291343380", "https://www.hostinger.com/blog/protecting-php2shell/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Hostinger affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "According to Hostinger's incident updates, their platform was not vulnerable to the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Impact Status: After conducting testing in their hosting environments, Hostinger confirmed their platform was not vulnerable and implemented extra layers of protection to block potential attack vectors. Patch/Rollout Status: Although their specific platform configurations prevented exploitation, Hostinger rolled out and deployed patched", "cited_urls": [ "https://statuspage.hostinger.com/", "https://pulsetic.com/status/hostinger/incidents/151752/" ], "names_status": true, "status_named": "not affected", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null } ] }, { "slug": "hostinger-india", "company": "Hostinger India", "canonical_domain": "hostinger.in", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.hostinger.com/blog/protecting-php2shell/", "statement_date": "Wednesday October 21, 2026; Updated October 22, 07:20 UTC", "status": "patched", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.hostinger.in/ (redirects to https://www.hostinger.com/in)", "https://www.hostinger.com/in (India storefront, no banner", "links to https://www.hostinger.com/blog/, https://statuspage.hostinger.com/, https://trust.hostinger.com/)", "https://www.hostinger.com/blog/protecting-php2shell/", "search:Hostinger India PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:31:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No India-specific statement; hostinger.in redirects to the India storefront at hostinger.com/in, so Hostinger's global post applies: \"is now installed on all Hostinger hosting servers except VPS\" and \"we rolled them out across the platform (completed October 22 at 06:44 UTC)\" quoted from https://www.hostinger.com/blog/protecting-php2shell/. VPS customers must update: \"if you manage PHP on your own server, update it and restart it now.\"; \"PHP 8.1 and older versions no longer get fixes from the PHP project\".", "ai_answer_note": null, "ai_answers": [] }, { "slug": "hostpapa", "company": "HostPapa", "canonical_domain": "hostpapa.com", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://status.hostpapa.com/ (fetch failed, robots_disallowed)", "https://www.hostpapastatus.com/ (no PHP incident", "newest items are emergency maintenance notices)", "https://www.hostpapa.com/blog/ (no PHP post)", "https://www.hostpapa.com/ (no banner)", "search:HostPapa PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Nothing found on the network status page (hostpapastatus.com, linked from hostpapa.com as Network Status), blog or homepage.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "hostwinds", "company": "Hostwinds", "canonical_domain": "hostwinds.com", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://status.hostwinds.com/ (only a Client Area notice, no PHP item)", "https://www.hostwinds.com/blog (newest post 14 Oct 2026)", "https://www.hostwinds.com/ (no banner)", "search:Hostwinds PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Nothing found on the status page, blog or homepage. Status page footer: \"© 2010-2026 Hostwinds, a HostPapa Inc. company.\" No Hostwinds security or trust page was found linked from the homepage.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "hotelogix", "company": "Hotelogix", "canonical_domain": "hotelogix.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Hotelogix PHP2Shell", "https://www.hotelogix.com/ (homepage)", "https://www.hotelogix.com/enterprise-grade-security-hlxe (security page, last updated 2025-07-16, no PHP mention)", "https://www.hotelogix.com/blog (newest post 28 September 2026)", "https://www.hotelogix.com/media-coverage (newest item July 2026)", "https://status.hotelogix.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "hoteltime-solutions", "company": "HotelTime Solutions", "canonical_domain": "hoteltime.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:HotelTime Solutions PHP2Shell", "https://www.hoteltime.com/ (homepage", "no links captured, no PHP mention)", "https://www.hoteltime.com/blog (fetch failed, robots disallowed)", "https://www.hoteltime.com/news (fetch failed, robots disallowed)", "https://www.hoteltime.com/security (fetch failed, robots disallowed)", "https://status.hoteltime.com/ (status page listing HotelTime, Vento, Libero, Confero, Global", "no PHP mention", "incident pages not opened)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Blog, news and security paths on hoteltime.com refuse automated reads (robots disallowed); the status page summary carries no PHP notice.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "housecall-pro", "company": "Housecall Pro", "canonical_domain": "housecallpro.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.housecallpro.com/", "https://housecallpro.safebase.us", "https://www.housecallpro.com/about/newsroom/", "https://www.housecallpro.com/about/press/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Trust Center updates list phishing and fake job offer alerts with no PHP item; newsroom items undated (page modified 2026-10-12); no status page link in site navigation.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "hubspot-crm", "company": "HubSpot CRM", "canonical_domain": "hubspot.com", "group": "index_vendor", "index_category": "crm", "statement_found": true, "statement_url": "https://status.hubspot.com/incidents/1vjy2fdyvnv5", "statement_date": "Oct 21, 2026 21:38 EDT (Investigating), Resolved 23:31 EDT", "status": "not affected", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "status page", "places_checked": [ "search:HubSpot PHP2Shell", "https://status.hubspot.com/ (status page, Oct 21, 2026 incident \"Update on PHP security vulnerability\")", "https://status.hubspot.com/incidents/1vjy2fdyvnv5 (statement)", "https://trust.hubspot.com/ (Trust Center update \"HubSpot Update on PHP Vulnerability\", Oct 22, 2026)", "https://valuegravity.io/insights/php2shell-marketing-automation-impact.html (third party, Value Gravity)" ], "last_checked_utc": "2026-10-23T02:14:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "PHP isn't part of HubSpot's infrastructure, and we are not aware of any impact to our platform or customers.", "notes": "\"PHP isn't part of HubSpot's infrastructure, and we are not aware of any impact to our platform or customers.\" quoted from https://status.hubspot.com/incidents/1vjy2fdyvnv5 (Investigating 21:38 EDT, Monitoring 22:00 EDT, Resolved 23:31 EDT, Oct 21, 2026). Trust Center update dated Oct 22, 2026, 02:54 UTC on https://trust.hubspot.com/: \"PHP is not part of HubSpot's infrastructure, and we are not aware of any impact to our platform or customers.\" Value Gravity's article (21 Oct, updated 22 Oct 2026) said HubSpot had published nothing; superseded by these pages.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "hyland", "company": "Hyland", "canonical_domain": "hyland.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Hyland PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.hyland.com/", "https://www.hyland.com/en/legal/hyland-trust-center", "https://security.hyland.com/ (Trust Center)", "https://www.hyland.com/en/company/newsroom/news (listing rendered without items)", "https://www.hyland.com/en/resources/product-news (newest 2026 Q1 releases)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trust Center (SafeBase) gates documents behind access requests; no advisory or dated notice. Newsroom listing did not render items on fetch. No status page located.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ice-mortgage-technology", "company": "ICE Mortgage Technology", "canonical_domain": "icemortgagetechnology.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:ICE Mortgage Technology PHP2Shell", "https://www.icemortgagetechnology.com/ (302 redirect to https://mortgagetech.ice.com/index, read)", "https://www.ice.com/privacy-security-center", "https://mortgagetech.ice.com/support (mentions a Status Center but gives no link)", "https://mortgagetech.ice.com/blog/the-ai-native-mortgage-supporting-intelligent-compliant-adoption (newest linked blog post, dated June 29, 2026)" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "icemortgagetechnology.com redirects to mortgagetech.ice.com. Press releases are hosted on ir.theice.com; none linked from the product site concern PHP. Status Center URL not published on the support page.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "icinga", "company": "Icinga", "canonical_domain": "icinga.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://icinga.com/blog/ (newest post 21 Oct 2026 on Icinga DB Web service grid, nothing on PHP2Shell)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Icinga Web, Icinga DB Web, Icinga Director and Icinga Certificate Monitoring listed Vulnerable or Investigation citing install docs only)", "search:Icinga PHP2Shell (web search budget exhausted in this run)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Icinga GmbH statement on PHP2Shell found on its blog as of the last check. NCSC-NL inventory lists Icinga Web as Vulnerable and the Icinga DB Web, Director and Certificate Monitoring modules as Investigation on the basis of PHP requirements, not a vendor statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ideal-computer-systems", "company": "Ideal Computer Systems", "canonical_domain": "idealcomputersystems.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.idealcomputersystems.com/", "https://www.idealcomputersystems.com/blog", "https://www.idealcomputersystems.com/news" ], "last_checked_utc": "2026-10-23T01:09:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust or status link in site navigation; blog listing undated; news newest item 25 Jul 2024.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "idexx-cornerstone-neo", "company": "IDEXX (Cornerstone, Neo)", "canonical_domain": "idexx.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.idexx.com/", "https://www.idexx.com/en/about-idexx/product-security/ (fetch failed)", "https://trust.idexx.com/", "https://status.idexxsoftware.com/", "https://www.idexx.com/en/about-idexx/news/ (redirects to https://ir.idexx.com/news-events/press-releases)", "https://ir.idexx.com/news-events/press-releases", "https://software.idexx.com/resources/blog-posts", "https://www.idexx.com/en/blogs/cornerstone-news/ (redirects to https://cornerstonehelphub.com/)", "https://cornerstonehelphub.com/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. Trust center lists certifications, policies and penetration test summaries, nothing on PHP. Software status page (status.idexxsoftware.com) shows DVMInsight scheduled maintenance 21 October 2026 17:00 to 18:53 EDT with no cause stated; no PHP or CVE mention. Newest press release 1 October 2026. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ids", "company": "IDS", "canonical_domain": "ids-astra.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.ids-astra.com/", "https://www.ids-astra.com/blog/", "https://www.ids-astra.com/news/" ], "last_checked_utc": "2026-10-23T01:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust or status link in site navigation; blog listing undated (titles only, includes general dealership cybersecurity guides, none naming PHP); news page has one item from May 5, 2015.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "impromed", "company": "ImproMed", "canonical_domain": "covetrus.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.covetrus.com/", "https://covetrus.com/about/newsroom/", "https://covetrus.com/insights-center/", "https://covetrus.com/legal/", "https://status.covetrus.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. ImproMed is a Covetrus product; the covetrus.com check (no security, trust or advisory page; newsroom and insights undated) covers it. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ineight", "company": "InEight", "canonical_domain": "ineight.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:InEight PHP2Shell", "https://ineight.com/security/ (fetch failed, client error)", "https://ineight.com/", "https://ineight.com/company/security/", "https://ineight.com/news/" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Security page has no PHP mention; newsroom shows undated customer and FedRAMP items, none about PHP; no status page link in site navigation.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "infinitt-healthcare", "company": "INFINITT Healthcare", "canonical_domain": "infinitt.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:INFINITT Healthcare PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.infinitt.com/ (fetch failed twice: server_error)", "https://www.infinittna.com/ (INFINITT North America site)", "https://www.infinittna.com/resources/ (newest press release October 15, 2026)" ], "last_checked_utc": "2026-10-23T01:40:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "infinitt.com could not be read (server error on both attempts). INFINITT North America site has no security, trust or status page; newest press release (15 October 2026) is a partnership announcement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "infios-mercurygate", "company": "Infios (MercuryGate)", "canonical_domain": "infios.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Infios MercuryGate PHP2Shell CVE-2026-109618", "https://infios.com/trust (fetch failed)", "https://infios.com/", "https://www.infios.com/en/customer-support", "https://trust.infios.com/", "https://status.infios.net/", "https://www.infios.com/en/knowledge-center/news" ], "last_checked_utc": "2026-10-23T00:21:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trust center (trust.infios.com) has no advisory; it lists an undated Security Across the Infios SaaS Portfolio whitepaper. Status page (status.infios.net) lists completed TMS and WM server maintenance and weekly patch windows 20 to 22 October 2026 with no mention of PHP or any CVE, and no incidents in the last 7 days. Newest news item 6 October 2026. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "inmotion-hosting", "company": "InMotion Hosting", "canonical_domain": "inmotionhosting.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://status.inmotionhosting.com/incidents/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a", "statement_date": "2026-10-22 10:24 UTC (Identified; first 2026-10-21 03:27 UTC)", "status": "patched partly", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://status.inmotionhosting.com/", "https://status.inmotionhosting.com/incidents/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a", "https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/ (fetch failed, client_error)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:33:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "PHP version upgrades are being committed and have already been performed across Shared and Dedicated servers.", "notes": "\"PHP version upgrades are being committed and have already been performed across Shared and Dedicated servers.\" (2026-10-22 01:02 UTC) and \"The PHP version upgrades for the VPS fleets are still in progress.\" (2026-10-22 10:24 UTC) quoted from https://status.inmotionhosting.com/incidents/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a (title: Security Maintenance: PHP Configuration Updates). Mitigation: default session.upload_progress.enabled disabled; CWP/CWP Admin ports restricted. Older PHP: \"We are awaiting the upstream security patch from CloudLinux for older PHP versions.\" (2026-10-21 20:16 UTC). Support news page could not be fetched.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is InMotion Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—InMotion Hosting’s PHP infrastructure was affected, but patching is not confirmed complete across every hosting environment. Its official advisory, updated October 22, 2026, explicitly addresses both CVE-2026-109618 and CVE-2026-109619. As checked on October 23, 2026, its latest detailed deployment statement says: | Hosting environment | Reported patch status | |---|---| | Shared, Reseller, WordPress Hosting | Patched, including CloudLinux", "cited_urls": [ "https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/", "https://status.inmotionhosting.com/" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is InMotion Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, InMotion Hosting is affected by PHP2Shell, and has been actively working on patching it. Here is a full breakdown: What is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, nicknamed \"PHP2Shell,\" are two critical PHP flaws that allow unauthenticated remote code execution — an attacker only needs to send a crafted web request, with no login required. Both are rated CVSS v4.0", "cited_urls": [ "https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619", "https://sansec.io/research/php2shell", "https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/", "https://status.inmotionhosting.com/incidents/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a", "https://status.inmotionhosting.com/", "https://www.activeset.co/blog/php2shell-host-status" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is InMotion Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. InMotion Hosting was affected because PHP2Shell impacts PHP installations serving web requests, but its patch status varies by hosting type. Dedicated servers: Patched. InMotion says patched PHP packages addressing both CVEs were applied across all dedicated-server infrastructure. Shared hosting: Patched/complete. CloudLinux released the fixed packages, and InMotion says they were being applied across shared-hosting servers. The PHP version", "cited_urls": [ "https://status.inmotionhosting.com/incidents/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a", "https://php2shellcheck.com/hosting-status/", "https://misservices.us/php2shell-cve-2026-109618-fix-guide", "https://arvindkumar.ca/blog/php2shell-wordpress/", "https://meowapps.com/php2shell-wordpress/", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell", "https://github.com/hkoeck/php2shell-status", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is InMotion Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, InMotion Hosting was affected by the PHP2Shell vulnerabilities ( and CVE-2026-109619). Patch Status: Patches are complete for shared hosting and dedicated servers (with backported updates possibly showing older version strings), while deployment for VPS is ongoing . Source: Official InMotion Hosting Status Page - Security Maintenance: PHP Configuration Updates . If you are using an InMotion Hosting VPS", "cited_urls": [ "https://status.inmotionhosting.com/incidents/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is InMotion Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, InMotion Hosting was affected by the \"php2shell\" vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which involve critical unauthenticated remote code execution flaws in PHP. InMotion Hosting took proactive mitigation steps and has been addressing the issue: Mitigation Action: Starting on October 20, 2026, InMotion Hosting began applying urgent security mitigations across their server infrastructure by disabling the default session.upload_progress.enabled PHP setting", "cited_urls": [ "https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/", "https://status.inmotionhosting.com/incidents/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null } ] }, { "slug": "innago", "company": "Innago", "canonical_domain": "innago.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Innago PHP2Shell", "https://innago.com/ (homepage, no security, trust, status or blog link captured, no notice)", "https://innago.com/blog/ (blog index showed \"Loading blog...\", no posts rendered)", "https://status.innago.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T02:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security or trust page is linked from innago.com. No PHP2Shell item found.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "innroad", "company": "innRoad", "canonical_domain": "innroad.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:innRoad PHP2Shell", "https://www.innroad.com/ (homepage", "no security or status link)", "https://www.innroad.com/blog/ (posts undated, none on PHP)", "https://www.innroad.com/security/ (fetch failed, client error)", "https://status.innroad.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "insightly", "company": "Insightly", "canonical_domain": "insightly.com", "group": "index_vendor", "index_category": "crm", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Insightly PHP2Shell", "https://www.insightly.com/security/ (security and compliance page, no PHP or CVE mention)", "https://status.insightly.com/ (status page)", "https://www.insightly.com/blog/ (newest post 09 Sep 2026, none on PHP)" ], "last_checked_utc": "2026-10-23T02:16:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for Oct 20 and Oct 21, 2026 and \"No incidents reported today.\" for Oct 22, 2026, quoted from https://status.insightly.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "instinct", "company": "Instinct", "canonical_domain": "instinct.vet", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.instinct.vet/", "https://instinct.vet/news/", "https://instinct.vet/blog/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security or trust page (SOC 2 badge only); system status is an on-page popup, not a status page. Newest news item 10 September 2026; newest blog post 21 October 2026 is about vet techs. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "insuredmine", "company": "InsuredMine", "canonical_domain": "insuredmine.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:InsuredMine PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.insuredmine.com/ (homepage", "no security or status link)", "https://www.insuredmine.com/blog/ (newest post October 9, 2026)", "https://www.insuredmine.com/security/ (general security page, no PHP or CVE mention)", "https://status.insuredmine.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "intelerad", "company": "Intelerad", "canonical_domain": "intelerad.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Intelerad PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.intelerad.com/", "https://www.intelerad.com/en/regulatory-compliance/", "https://www.intelerad.com/en/newsroom/ (newest press release February 4, 2026)", "https://www.intelerad.com/en/blog/ (newest post 2026-10-12)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security advisory, trust center or status page linked from the site; support sits behind the Service Portal login. Intelerad is now a GE HealthCare company (site banner).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "intellitrans", "company": "IntelliTrans", "canonical_domain": "intellitrans.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.intellitrans.com/", "https://www.intellitrans.com/resources?category_equal=%5B%22News%22%2C%22Press+Release%22%5D", "https://www.intellitrans.com/resources" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or status page on intellitrans.com (support portal is a service desk). Newest resource item 9 September 2026. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "intravet", "company": "IntraVet", "canonical_domain": "intravet.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.intravet.com/ (fetch failed, robots disallowed)", "https://intravet.com/ (fetch failed, robots disallowed)", "https://www.intravet.com/blog (fetch failed, robots disallowed)", "https://www.pattersonvet.com/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted). intravet.com could not be fetched (robots disallowed on every page tried). Parent site pattersonvet.com homepage mentions IntraVet only as a product link and has no security advisory. Nothing on PHP2Shell located; the intravet.com site itself remains unread.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "invoice-ninja", "company": "Invoice Ninja", "canonical_domain": "invoiceninja.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://invoiceninja.com/blog/ (newest post 1 Oct 2026, nothing on PHP2Shell)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Invoice Ninja self-hosted server listed Vulnerable citing install docs only)", "search:Invoice Ninja PHP2Shell (web search budget exhausted in this run)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Invoice Ninja statement on PHP2Shell found on its blog as of the last check. NCSC-NL inventory lists the Invoice Ninja self-hosted server as Vulnerable on the basis of PHP requirements, not a vendor statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ionos", "company": "IONOS", "canonical_domain": "ionos.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.ionos-status.com/incidents/3fkdbfd8zldr", "statement_date": "Resolved Oct 22, 2026 - 06:10 EDT (Identified Oct 21, 2026 - 11:31 EDT); newsroom article listed October 22, 2026", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "status page", "places_checked": [ "https://www.ionos.com/ (footer links)", "https://www.ionos-status.com/", "https://www.ionos-status.com/incidents/3fkdbfd8zldr", "https://www.ionos.com/newsroom/", "https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/", "https://www.ionos.com/it-security (fetch limit at first attempt, not read)", "search:IONOS PHP2Shell CVE-2026-109618 statement (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:35:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Websites and hosting at IONOS are protected.", "notes": "\"Websites and hosting at IONOS are protected.\" (Resolved, Oct 22, 2026 - 06:10 EDT) quoted from https://www.ionos-status.com/incidents/3fkdbfd8zldr (title: Security maintenance: Short interruptions possible on PHP-based services; ionos-status.com is linked from ionos.com as Status Page). Newsroom article https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/ (listed October 22, 2026; article body undated): \"IONOS has already applied the official security update on all platforms it operates itself\"; covers Web Hosting, Managed WordPress, MyWebsite 8, Managed Nextcloud, HiDrive Next; customized PHP configurations and firewall rules were added before the release. Mixed: VPS, Bare Metal and other self-managed customers must install the PHP update themselves. No fixed version, restart or EOL statement.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is IONOS affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—IONOS’s PHP-based services were in scope, and IONOS confirms it has patched all platforms it operates itself. Self-managed servers are the exception. As of October 23, 2026: IONOS-operated hosting: patched. IONOS names Web Hosting, Managed WordPress, MyWebsite 8, Managed Nextcloud, and HiDrive Next, and says customers on its operated platforms need not take action. Its official statement says: “IONOS", "cited_urls": [ "https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/", "https://www.ionos-status.com/incidents/3fkdbfd8zldr" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is IONOS affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "I was unable to find any specific statement, advisory, or blog post from IONOS (the web hosting and cloud provider) addressing PHP2Shell (CVE-2026-109618 and CVE-2026-109619) — either confirming they are affected or announcing a patch. It is important to note that the IONIX result that appeared in searches refers to IONIX (a cybersecurity attack surface management company), which is", "cited_urls": [ "https://en.wikipedia.org/wiki/PHP2Shell", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/" ], "names_status": true, "status_named": "no public statement located", "matches_statement": false, "cites_company_page": false, "says_no_statement": true, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is IONOS affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "There is no public evidence in the available sources confirming that IONOS itself was affected or that IONOS has patched its managed hosting infrastructure. What can be established: PHP2Shell affects vulnerable PHP installations serving web requests. PHP released fixes in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on October 21, 2026. Older PHP 7.4–8.1 branches received only source-level backports, while", "cited_urls": [ "https://github.com/hkoeck/php2shell-status", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://github.com/NCSC-NL/php2shell", "https://sansec.io/research/php2shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://en.wikipedia.org/wiki/PHP2Shell", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is IONOS affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "⁠IONOS is technically affected because the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) impact the core PHP engine across all hosting environments running unpatched PHP, though official public confirmation or status updates directly from IONOS regarding whether they have completed patching remain limited or unspecified in their documentation as of October 22, 2026 . What is Affected The Vulnerability: PHP2Shell consists", "cited_urls": [ "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.resetera.com/threads/20-oct-2026-remote-code-execution-vulnerabilities-affecting-every-php-version-from-php-5-onward-update-now.1666003/page-2", "https://security.utoronto.ca/advisories/security-advisory-critical-unauthenticated-rce-in-php-php2shell/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://www.reddit.com/r/Wordpress/comments/1xbmw05/php_cve_notice/", "https://www.reddit.com/r/Wordpress/comments/1xbk4kp/psa_php_emergency_patch_drops_today_i_built_a/", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce#:~:text=On%20October%2021%2C%202026%2C,further%20system%20compromise." ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is IONOS affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "As an infrastructure and hosting provider that supports various PHP versions across its shared hosting, VPS, and cloud platforms, IONOS utilizes PHP configurations that are fundamentally subject to the core PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). These critical remote code execution (RCE) flaws affect unpatched versions of PHP globally. However, public official statements or dedicated advisory trackers", "cited_urls": [ "https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619", "https://www.ionix.io/blog/php2shell-cve-2026-109618-cve-2026-109619-and-how-ionix-is-helping-you-respond/", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null } ] }, { "slug": "jack-henry", "company": "Jack Henry", "canonical_domain": "jackhenry.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Jack Henry PHP2Shell", "https://www.jackhenry.com/", "https://www.jackhenry.com/what-we-offer/information-security-technology", "https://www.jackhenry.com/resources?types=type-press-release (listing rendered as an empty template)", "https://www.jackhenry.com/fintalk (newest post Oct 21, 2026)", "https://www.jackhenry.com/fintalk/jack-henry-connect-day-3-recap (dated Oct 21, 2026, no PHP content)" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Information Security page is a services product page. No trust center or status page linked from the homepage. Press release listing did not render items on fetch.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "jira", "company": "Jira", "canonical_domain": "atlassian.com", "group": "index_vendor", "index_category": "project_management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Atlassian PHP2Shell", "https://www.atlassian.com/trust/security/advisories (security advisories, newest October 2026 Security Bulletin and CVE-2026-21589, no PHP item)", "https://www.atlassian.com/trust/security/bulletins/october-2026-security-bulletin (fetch failed, client error)", "https://status.atlassian.com/ (status page)" ], "last_checked_utc": "2026-10-23T02:02:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Atlassian status page shows \"No incidents reported.\" for Oct 20 and Oct 21 and \"No incidents reported today.\" for Oct 22, 2026, \"All Systems Operational\", quoted from https://status.atlassian.com/. Advisory list has no PHP2Shell item.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "jobber", "company": "Jobber", "canonical_domain": "getjobber.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://getjobber.com/", "https://www.getjobber.com/security/", "https://www.getjobber.com/about/media/", "https://productupdates.getjobber.com/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Security page shows Last Updated Date: October 30, 2025 with no PHP mention; press items undated; product updates newest October 20, 2026 (Yelp lead sync), no security item; no status page link in site navigation.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "joblogic", "company": "Joblogic", "canonical_domain": "joblogic.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Joblogic PHP2Shell", "https://www.joblogic.com/ (homepage", "no security or status link)", "https://www.joblogic.com/blog (newest post Oct 21, 2026)", "https://www.joblogic.com/blog/what-is-ppm-maintenance (post dated 21 October 2026, no PHP mention)", "https://support.joblogic.com/docs/latest-release-notes (updated Sep 29, 2026, no PHP mention)", "https://www.joblogic.com/security (fetch failed, client error)", "https://status.joblogic.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Newest blog post (21 October 2026) is a PPM maintenance guide with no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "jobtread", "company": "JobTread", "canonical_domain": "jobtread.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:JobTread PHP2Shell", "https://www.jobtread.com/", "https://www.jobtread.com/news", "https://www.jobtread.com/blog" ], "last_checked_utc": "2026-10-23T00:31:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status link in site navigation; news newest item October 16, 2026; blog newest post October 14, 2026; no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "jonas-construction", "company": "Jonas Construction", "canonical_domain": "jonasconstruction.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Jonas Construction Software PHP2Shell", "https://www.jonasconstruction.com/", "https://www.jonasconstruction.com/blog/" ], "last_checked_utc": "2026-10-23T00:29:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust, status or news link in site navigation; blog listing shows no dates and no security post.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "joomla", "company": "Joomla", "canonical_domain": "joomla.org", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://developer.joomla.org/security-centre.html (newest [20260916], 16 Sep 2026)", "https://www.joomla.org/announcements.html (newest 13 Oct 2026, Joomla 6.2)", "https://www.joomla.org/announcements/general-news.html (newest dated 5 Feb 2024)", "https://magazine.joomla.org/ (no PHP2Shell content)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Joomla 6.x listed Vulnerable citing technical requirements only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Joomla statement on PHP2Shell found in the Security Centre, announcements, general news or magazine as of the last check. NCSC-NL inventory lists Joomla 6.x as Vulnerable on the basis of PHP requirements, not a project statement. Synology's 22 Oct 2026 statement lists its Joomla package among affected PHP-dependent packages.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Joomla affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Joomla is affected when it runs on a vulnerable PHP runtime. A fix is available, but it is a PHP update, not a Joomla CMS patch. As of October 23, 2026, NCSC-NL lists Joomla 6.x as “Vulnerable” for both CVE-2026-109618 and CVE-2026-109619, explicitly identifying a PHP runtime upgrade as the remediation. Confirmed impact: The discovering researchers demonstrated unauthenticated remote", "cited_urls": [ "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_j.md", "https://www.php2shell.com/", "https://www.php.net/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Joomla affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Great — here is a comprehensive answer based on multiple reputable sources: Is Joomla Affected by PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? ✅ Yes — Joomla Is Affected The bugs allow unauthenticated remote code execution and Heartbleed-style memory disclosure in PHP itself, independent of the application running on top of it. This is the critical point: the vulnerabilities are not in", "cited_urls": [ "https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://patchmon.net/blog/php2shell-cve-2026-109618-cve-2026-109619-php-rce-patch", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://github.com/Anton-Barinov/php2shell-patches" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Joomla affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Joomla sites are affected when they run a vulnerable PHP version, because PHP2Shell is a flaw in the PHP runtime—not in Joomla’s own code. Researchers demonstrated unauthenticated remote code execution against a Joomla container image. Joomla has not “patched” this in a Joomla release. Updating Joomla alone does not remediate the issue; the underlying PHP installation must be", "cited_urls": [ "https://www.nextsoftware.dev/news/php2shell-is-your-joomla-site-safe", "https://www.infyways.com/php2shell-joomla-wordpress/", "https://sansec.io/research/php2shell", "https://php2shell.eu/", "https://www.rescana.com/post/php-rce-flaws-patch-october-2026-prepare-now", "https://www.zafran.io/resources/php2shell-everything-you-need-to-know-about-the-two-critical-php-vulnerabilities", "https://github.com/NCSC-NL/php2shell", "https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:33.102Z", "question": "Is Joomla affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Joomla deployments can be exposed to PHP2Shell (CVE-2026-109618 and CVE-2026-109619) because the critical remote code execution flaws reside in the PHP core engine runtime itself, rather than in Joomla's application code. How to Fix / Mitigation Joomla Patch Status: Because the vulnerabilities exist in the underlying PHP language interpreter, fixing the issue requires updating the PHP runtime on", "cited_urls": [ "https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619", "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.herodevs.com/blog-posts/php2shell-cve-2026-109618-cve-2026-109619-php-rce", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Joomla affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Is Joomla affected? Yes. The \"PHP2Shell\" vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are core remote code execution (RCE) and memory-disclosure flaws residing within the underlying PHP engine itself, rather than application-specific code. Security researchers have demonstrated that unauthenticated RCE and memory disclosure via these PHP flaws affect applications running on vulnerable PHP runtimes, including Joomla, WordPress, and Drupal. Has it patched?", "cited_urls": [ "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "https://www.wiz.io/blog/php2shell-php-rce" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "kahua", "company": "Kahua", "canonical_domain": "kahua.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Kahua PHP2Shell", "https://www.kahua.com/security/", "https://www.kahua.com/blog/ (fetch failed, client error)", "https://www.kahua.com/news/" ], "last_checked_utc": "2026-10-23T00:24:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Security and compliance page has no PHP mention; news newest item 20 Oct 2026 is a research announcement, no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "kickserv", "company": "Kickserv", "canonical_domain": "kickserv.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Kickserv PHP2Shell", "search:Kickserv CVE-2026-109618", "https://www.kickserv.com/security (security page, no PHP or CVE mention)", "https://status.kickserv.com/ (status page)", "https://www.kickserv.com/blog (blog, posts undated, none on PHP)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for Oct 20 and Oct 21, 2026 and \"No incidents reported today.\" for Oct 22, 2026, quoted from https://status.kickserv.com/. Security page carries no advisory.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "kimai", "company": "Kimai", "canonical_domain": "kimai.org", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://www.kimai.org/blog/2026/php-cve", "statement_date": "21 Oct 2026 (updates 21 Oct 10:00 and 21 Oct 19:30)", "status": "patched", "fixed_version_named": "yes: Kimai 2.70.1 (Docker rebuild); PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://www.kimai.org/blog/ (listing stale, newest Dec 2025)", "https://www.kimai.org/blog/2026/php-cve.html (client error)", "https://www.kimai.org/blog/2026/php-cve", "https://github.com/kimai/kimai/releases/tag/2.70.1", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Kimai listed Fix citing release 2.70.1 and PR 6262)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"Critical PHP security update: what it means for Kimai users\". Mixed: \"All Kimai Cloud systems were updated within minutes after the official PHP releases were published.\"; self-hosted installs must update PHP themselves and Docker users must pull updated images; \"Updating Kimai alone won't fix this: PHP itself has to be updated on every server that runs it.\" Both quoted from the statement URL. Release 2.70.1 (21 Oct) \"exists mainly to trigger a rebuild of our Docker images, which will the ship fixed PHP versions\" quoted from https://github.com/kimai/kimai/releases/tag/2.70.1. No CVE IDs named in the post.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "kinsta", "company": "Kinsta", "canonical_domain": "kinsta.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://status.kinsta.com/incidents/c0c6xl1ghpb2", "statement_date": "Oct 22, 2026 - 08:26 UTC (Resolved; first update Oct 21, 2026 - 19:04 UTC)", "status": "patched", "fixed_version_named": "yes: PHP 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, 8.5 (branches only, no point releases)", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://status.kinsta.com/incidents/c0c6xl1ghpb2", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "All sites are protected, the PHP security updates have been rolled out across the platform", "notes": "\"All sites are protected, the PHP security updates have been rolled out across the platform\" quoted from https://status.kinsta.com/incidents/c0c6xl1ghpb2 (title: PHP Security Vulnerability Update). Patches rolled out for PHP 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 and 8.5; Cloudflare and local configuration mitigations stay in place for all sites until further notice. 19:04 UTC update: \"No action is required on your end.\" (customers on 8.3/8.5 could switch PHP version and back to apply the patch immediately).", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Kinsta affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Kinsta has completed patching its platform. As of October 23, 2026, its official incident report marks the PHP security issue resolved, with rollout completed on October 22, 2026, at 08:26 UTC. Was it affected? Kinsta treated its PHP infrastructure as requiring patches; it did not claim the platform was inherently unaffected. During rollout, it reported that Cloudflare protections and", "cited_urls": [ "https://status.kinsta.com/incidents/c0c6xl1ghpb2" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Kinsta affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Kinsta was affected by PHP2Shell, and it has fully patched. Here is a detailed breakdown: What Is PHP2Shell? CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. CVE-2026-109618 stems from how PHP handles out-of-memory (OOM) errors. If memory runs out while PHP's", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://sansec.io/research/php2shell", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers", "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/", "https://www.activeset.co/blog/php2shell-host-status" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Kinsta affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Kinsta was affected because PHP2Shell impacts the PHP runtime, including versions Kinsta offered, and Kinsta reported that it rolled out the security updates across its platform. Kinsta’s remediation was completed at 08:26 UTC on October 22, 2026, covering PHP branches 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, and 8.5. Its incident update said that all sites were protected and", "cited_urls": [ "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_k.md", "https://php2shellcheck.com/hosting-status/", "https://arvindkumar.ca/blog/php2shell-wordpress/", "https://www.digitalapplied.com/blog/php2shell-fixes-by-distro-control-panel-php-version", "https://mallory.ai/blog/php-rce-rapid-response", "https://github.com/NCSC-NL/php2shell", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://en.wikipedia.org/wiki/PHP2Shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Kinsta affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Kinsta was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and all customer sites have been protected as Kinsta rolled out the necessary PHP security updates across its platform. Key Details & Status Impact: The vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affected PHP runtime environments utilized across hosted applications. Patch Status: Patched and rolled out across Kinsta's infrastructure. Kinsta confirmed that", "cited_urls": [ "https://status.kinsta.com/history", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.cycognito.com/blog/emerging-threat-php2shell-cve-2026-109618-109619/", "https://community.kinsta.com/t/critical-php-security-release/8314/30", "https://community.kinsta.com/t/critical-php-security-release/8314" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Kinsta affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: Because Kinsta hosts WordPress and other PHP-based applications, servers running vulnerable versions of PHP (branches 8.2 through 8.5) were inherently exposed to the \"PHP2Shell\" remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) prior to mitigation. Major managed hosting providers like Kinsta received early notification/access or moved rapidly to prepare and deploy updates as emergency patches dropped. Patch Status:", "cited_urls": [ "https://www.bitsight.com/blog/critical-vulnerability-alert-cve-2026-109618-and-cve-2026-109619-php2shell", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.linkedin.com/news/story/php2shell-exploit-rattles-cybersecurity-pros-9537818/", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "kuebix-by-freightwise", "company": "Kuebix by FreightWise", "canonical_domain": "kuebix.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.kuebix.com/", "https://www.freightwisellc.com/resources/?_sft_category=news", "https://www.freightwisellc.com/resources/?_sft_category=blog", "https://freightwisellc.zendesk.com/hc/en-us (fetch failed)" ], "last_checked_utc": "2026-10-23T01:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. kuebix.com has no security, trust or status page; news and blog live on freightwisellc.com. Newest item 20 October 2026 is the Kuebix AI launch, not security. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "landlord-studio", "company": "Landlord Studio", "canonical_domain": "landlordstudio.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Landlord Studio PHP2Shell", "search:Landlord Studio PHP2Shell CVE-2026-109618", "https://www.landlordstudio.com/security (fetch failed)", "https://www.landlordstudio.com/", "https://www.landlordstudio.com/blog", "https://help.landlordstudio.com/en/" ], "last_checked_utc": "2026-10-23T00:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page linked from the homepage. Newest blog post 16 October 2026. Help center has no security notice. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "laravel", "company": "Laravel", "canonical_domain": "laravel.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://laravel.com/blog/php-critical-vulnerability-response-updates", "statement_date": "Oct 21, 2026 (Updated 10/22 - 13:25 UTC)", "status": "patched", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (Laravel Cloud)", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://laravel.com/blog/php-critical-vulnerability-response-updates", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Laravel Cloud and Vapor listed Fix citing this post", "Laravel 13 framework listed Vulnerable citing deployment docs)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"PHP critical vulnerability response updates\". Mixed: Laravel Cloud fully patched: \"We applied the patches in place, so your applications stayed online, and no redeploy was needed.\" quoted from the statement URL; Forge customers must click Update PHP per server (Ubuntu 20.04 or older cannot be updated, migrate); Vapor patched runtimes live, native runtimes should be redeployed and \"If your application uses a custom or Docker image runtime, you will need a new deployment, not just a redeploy.\" Envoyer back online. PHP 8.0 and 8.1: no patch, upgrade to 8.2 or later. No CVE IDs named; self-hosted framework users not addressed.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Laravel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Laravel applications are affected when running on vulnerable PHP. Fixes are available, but the fix is a PHP runtime update, not a Laravel framework update. These CVEs concern PHP internals, and PHP warns that all installations serving web requests are at risk. Evidence that Laravel is affected The original Calif Research PHP2Shell write-up explicitly lists Laravel 13.11 among applications", "cited_urls": [ "https://www.php.net/archive/2026.php", "https://calif.io/php2shell", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_l.md?utm_source=openai" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Laravel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of what is known about PHP2Shell (CVE-2026-109618 & CVE-2026-109619) and its impact on Laravel: ⚠️ PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — Impact on Laravel What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code on a web server without logging", "cited_urls": [ "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://sansec.io/research/php2shell", "https://securinglaravel.com/laravel-security-notice-critical-php-security-release/", "https://rahulranjan.org/2026/10/22/php2shell-cve-2026-109618-cve-2026-109619-explained/", "https://vercel.com/kb/bulletin/php2shell-security-bulletin", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://en.wikipedia.org/wiki/PHP2Shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Laravel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Laravel applications can be affected, but the vulnerability is in the underlying PHP runtime, not in Laravel’s framework code. An attacker can exploit vulnerable PHP before Laravel application code runs, so updating Laravel or running composer update does not remediate it. PHP released fixes on October 21, 2026: PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35 Therefore, Laravel", "cited_urls": [ "https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026?ref=securinglaravel.com", "https://www.brillmark.com/php2shell-php-vulnerability-patch/", "https://securinglaravel.com/laravel-security-notice-critical-php-security-release/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://note.com/zenkok/n/n9550d4455982?hl=en", "https://daily.dev/posts/critical-php-security-update-due-october-21-at-14-00-utc-57ho7acc0", "https://github.com/NCSC-NL/php2shell", "https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html?m=1&hl=en", "https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Laravel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Laravel is not uniquely affected by a framework-specific vulnerability; instead, Laravel applications are affected if they run on a vulnerable version of the underlying PHP runtime (CVE-2026-109618 and CVE-2026-109619). Patch and Fix Details The Flaw: PHP2Shell is a core PHP engine flaw rather than a Laravel code defect. The Fix: The PHP Group released security updates on October 21,", "cited_urls": [ "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Laravel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Laravel itself as a PHP framework contains no direct vulnerability code for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), because these are critical core PHP engine vulnerabilities (rated 9.2 CVSS v4.0 for remote code execution via memory/OOM mismanagement). However, any Laravel application running on an unpatched version of PHP is vulnerable. Laravel applications do not need a framework patch; instead, the underlying", "cited_urls": [ "https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026", "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "laravel-cloud", "company": "Laravel Cloud", "canonical_domain": "cloud.laravel.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://laravel.com/blog/php-critical-vulnerability-response-updates", "statement_date": "Oct 21, 2026; Updated 10/22 - 13:25 UTC", "status": "patched", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://blog.laravel.com/ (redirects to https://laravel.com/blog)", "https://laravel.com/blog", "https://laravel.com/blog/php-critical-vulnerability-response-updates", "https://status.laravel.com/ (no PHP incident", "Cloud not a component)", "https://cloud.laravel.com/ (redirects to https://laravel.com/cloud, not read)", "search:Laravel Cloud PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "We have patched every running application on Laravel Cloud with the PHP and Node.js security releases and deployments have resumed.", "notes": "\"We have patched every running application on Laravel Cloud with the PHP and Node.js security releases and deployments have resumed.\" \"We applied the patches in place, so your applications stayed online, and no redeploy was needed.\" \"Your applications now run PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on the version you use.\" quoted from https://laravel.com/blog/php-critical-vulnerability-response-updates (title: PHP critical vulnerability response updates). New deployments use updated base images. Same post covers Forge, Vapor and Envoyer; PHP 8.0 and 8.1: \"no patch is available.\" Post says it will be updated frequently.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "laravel-forge", "company": "Laravel Forge", "canonical_domain": "forge.laravel.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://laravel.com/blog/php-critical-vulnerability-response-updates", "statement_date": "Oct 21, 2026; Updated 10/22 - 13:25 UTC", "status": "customer must update", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://laravel.com/blog", "https://laravel.com/blog/php-critical-vulnerability-response-updates", "https://status.laravel.com/ (no PHP incident", "Forge not a component)", "https://forge.laravel.com/ (redirects to https://laravel.com/forge, not read)", "search:Laravel Forge PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "If you're using PHP 8.2, 8.3, 8.4 or 8.5, go to your server in Forge and click 'Update PHP.' Do this for each server.", "notes": "\"If you're using PHP 8.2, 8.3, 8.4 or 8.5, go to your server in Forge and click 'Update PHP.' Do this for each server.\" \"If this fails, please update PHP over SSH.\" \"If your server runs Ubuntu 20.04 or older, you will not be able to update PHP.\" quoted from https://laravel.com/blog/php-critical-vulnerability-response-updates. PHP 8.0 and 8.1: \"no patch is available.\" (upgrade to 8.2+). Forge is a server management tool; the PHP runtime on customer servers is the customer's to update via the one-click Update PHP button; updates may take longer than usual due to demand.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "lawcus", "company": "Lawcus", "canonical_domain": "lawcus.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Lawcus PHP2Shell", "https://www.lawcus.com/", "https://lawcus.com/bank-grade-security/", "https://lawcus.com/blog/", "https://lawcus.com/law-firm-client-portal-communication-plan/ (blog post dated 20th October 2026, no PHP content)", "https://lawcus.com/whats-new/ (newest entry October 16, 2026)" ], "last_checked_utc": "2026-10-23T00:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page linked from the homepage.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "leap", "company": "Leap", "canonical_domain": "leaptodigital.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Leap leaptodigital PHP2Shell", "https://www.leaptodigital.com/", "https://status.leaptodigital.com", "https://leaptodigital.com/blog" ], "last_checked_utc": "2026-10-23T00:31:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security or trust link in site navigation; status page shows no incidents 20 to 22 Oct 2026; blog newest post September 25, 2026.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "leap-legal-software", "company": "LEAP Legal Software", "canonical_domain": "leap.us", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:LEAP Legal Software PHP2Shell", "https://www.leap.us/ (302 redirect to https://www.leaplegalsoftware.com/us/)", "https://www.leaplegalsoftware.com/us/ (US homepage, footer Security Statement and Media links, no status page, no notice)", "https://www.leaplegalsoftware.com/us/blog/ (newest post October 16, 2026, none on PHP)" ], "last_checked_utc": "2026-10-23T02:07:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "leap.us redirects to leaplegalsoftware.com/us. No status page linked. No PHP2Shell item on the US site or blog.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "lendingpad", "company": "LendingPad", "canonical_domain": "lendingpad.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:LendingPad PHP2Shell", "https://www.lendingpad.com/", "https://trust.lendingpad.com/ (Trust Center)", "https://lendingpad.com/resources/ (newest item Sept 3, 2026)" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trust Center (SafeBase) lists controls and SOC 2 Type 2 only; no advisory or dated notice. No status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "lendingwise", "company": "LendingWise", "canonical_domain": "lendingwise.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:LendingWise PHP2Shell", "https://www.lendingwise.com/", "https://lendingwise.trustshare.com/home (Trust Center, body not retrievable, JavaScript only)", "https://lendingwise.statuspage.io/ (9 to 23 October 2026 read)", "https://lendingwise.releasenotes.io/ (entries did not render)" ], "last_checked_utc": "2026-10-23T01:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"All Systems Operational\" and \"No incidents reported\" for 20, 21, 22 and 23 October 2026 (quoted from https://lendingwise.statuspage.io/). Trust Center content could not be read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "librenms", "company": "LibreNMS", "canonical_domain": "librenms.org", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://community.librenms.org/c/announcements/5 (newest topics 20 to 22 Oct 2026: fping permissions alert, 26.10.0 issues", "nothing on PHP2Shell)", "https://www.librenms.org/", "https://github.com/librenms/librenms/releases (newest 26.9.1.1, 22 Sep 2026, nothing on PHP2Shell)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (LibreNMS listed Vulnerable citing install docs only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No LibreNMS statement on PHP2Shell found in the community announcements, project site or release notes as of the last check. NCSC-NL inventory lists LibreNMS as Vulnerable on the basis of PHP requirements, not a project statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "lightspeed-dms", "company": "Lightspeed DMS", "canonical_domain": "lightspeeddms.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.lightspeeddms.com/", "https://www.lightspeeddms.com/blog/", "https://www.lightspeeddms.com/news/ (fetch failed, client error)", "https://www.lightspeeddms.com/about-us/ (fetch failed, client error)", "https://www.lightspeeddms.com/support/" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust or status link in site navigation; blog listing undated with no security post; support page (metadata modified 2026-08-25) has no security bulletin.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "linarc", "company": "Linarc", "canonical_domain": "linarc.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Linarc construction PHP2Shell", "https://www.linarc.com/", "https://www.linarc.com/in-the-news" ], "last_checked_utc": "2026-10-23T00:31:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status link in site navigation; news newest item August 2026; no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "liquid-web", "company": "Liquid Web", "canonical_domain": "liquidweb.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://status.liquidweb.com/incidents/6bfpxwg75xgj", "statement_date": "Oct 22, 2026 - 10:33 EDT (latest update; first Oct 21, 2026 - 09:24 EDT)", "status": "patching", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; Plesk 18.0.81.4; cPanel vendor backports 8.1.34-5, 8.0.30-12, 7.4.33-19", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://status.liquidweb.com/incidents/6bfpxwg75xgj", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Our Engineering teams are actively working to deploy patched PHP builds across our hosting infrastructure.", "notes": "\"Our Engineering teams are actively working to deploy patched PHP builds across our hosting infrastructure.\" and \"If you are not currently patched, please try running a package update through your control panel.\" quoted from https://status.liquidweb.com/incidents/6bfpxwg75xgj (title: PHP Security Vulnerability Assessment (CVE-2026-109618 & CVE-2026-109619)). No completion notice at this check. Customers on EOL PHP told to update code to a supported version and switch; Plesk list marks 8.1, 8.0, 7.4 as EOL with builds dated 21 Oct 2026.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Liquid Web affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Liquid Web lists affected hosting services and is deploying patches, but has not confirmed that all systems are patched. As of my check on October 23, 2026, its latest official update is dated October 22, 2026, at 3:28 p.m. EDT. Affected services: Its PHP2Shell incident lists Cloud Dedicated, Cloud VPS Hosting, cPanel, InterWorx, and Plesk. This does not mean", "cited_urls": [ "https://status.liquidweb.com/incidents/6bfpxwg75xgj" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Liquid Web affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on my research, I was not able to find any specific statement, advisory, or announcement from Liquid Web regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619). There is no publicly available source — as of today, October 23, 2026 — in which Liquid Web has confirmed whether it is affected or has patched these vulnerabilities. I cannot fabricate or assume their", "cited_urls": [ "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://sansec.io/research/php2shell", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": true, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Liquid Web affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Liquid Web was affected if its systems were running unpatched PHP, because PHP2Shell affects PHP versions dating back to 5.4. Liquid Web’s incident notice said its hosting infrastructure was under assessment and that, initially, no patches had yet been deployed to production. Liquid Web subsequently listed patched builds for its platforms, including: cPanel: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, plus", "cited_urls": [ "https://pulsetic.com/status/liquid-web/incidents/151471/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/NCSC-NL/php2shell", "https://github.com/hkoeck/php2shell-status", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md", "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/", "https://sansec.io/research/php2shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://en.wikipedia.org/wiki/PHP2Shell" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Liquid Web affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Liquid Web is affected by the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 _BLzaaqjPIOexur8PmZGXoQ8_17 and CVE-2026-109619 ), and as of October 21–22, 2026, the company was actively rolling out emergency patches and mitigations across its hosting environments. Status & Impact Vulnerability: PHP2Shell affects web servers running PHP 5.4 and later, allowing unauthenticated remote code execution (CVSS score of 9.2). Liquid", "cited_urls": [ "https://pulsetic.com/status/liquid-web/incidents/151471/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers", "https://www.imperva.com/blog/php2shell-vulnerability-updates/", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell", "https://status.liquidweb.com/", "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Liquid Web affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Liquid Web is assessing and addressing the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which affect various server configurations running vulnerable PHP versions. According to their official status and engineering response: Impact Status: Liquid Web's Security and Engineering teams actively reviewed hosting environments to determine potential impact across servers running vulnerable PHP iterations. Patch/Mitigation Status: Liquid Web stated they are implementing", "cited_urls": [ "https://status.liquidweb.com/", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "litespeed", "company": "LiteSpeed", "canonical_domain": "litespeedtech.com", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://blog.litespeedtech.com/ (newest post 19 Oct 2026, not PHP)", "https://www.litespeedtech.com/ (no banner)", "https://www.litespeedtech.com/products/litespeed-web-server/release-log (newest entry 09-23-2026)", "https://www.litespeedtech.com/support/forum/", "https://www.litespeedtech.com/support/forum/threads/new-php-security-issue.24201/", "search:LiteSpeed PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No blog post, release-log entry or homepage notice. In the user-started forum thread \"New PHP security issue\" (https://www.litespeedtech.com/support/forum/threads/new-php-security-issue.24201/) a LiteSpeed Administrator (abk) posted \"Correct, this is the latest status, shared on our Slack Community\" with an image attachment whose content is not readable here, so no status can be assigned from it; users in the thread claim the LiteSpeed repository was updated for PHP 7.4 and up (user claims, not staff statements).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "litify", "company": "Litify", "canonical_domain": "litify.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Litify PHP2Shell", "https://www.litify.com/security/ (fetch failed, client error)", "https://www.litify.com/ (homepage, no security, trust or status link in header or footer, no notice)", "https://www.litify.com/news (newsroom, items undated, none on PHP)" ], "last_checked_utc": "2026-10-23T02:05:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from the homepage. Newsroom items carry no PHP2Shell statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "little-hotelier", "company": "Little Hotelier", "canonical_domain": "littlehotelier.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Little Hotelier PHP2Shell", "https://www.littlehotelier.com/ (homepage", "footer security link points to parent SiteMinder)", "https://www.siteminder.com/security/ (SiteMinder security policy page, no PHP or CVE mention", "links Security Updates page)", "https://www.siteminder.com/security/updates/ (SiteMinder Security Updates page, newest entries 28 July 2025, no PHP or CVE mention)", "https://www.littlehotelier.com/news/ (items undated, none on PHP)", "https://www.littlehotelier.com/blog/ (posts undated, none on PHP)", "https://status.siteminder.com/ (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Little Hotelier is a SiteMinder brand; its security link goes to siteminder.com, whose Security Updates page lists nothing newer than 28 July 2025 (phishing and employment-scam notices).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "loanpro", "company": "LoanPro", "canonical_domain": "loanpro.io", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": true, "statement_url": "https://status-loanpro.simnang.com/incidents/8pp4lvy410yp", "statement_date": "Oct 22, 2026 - 10:56 MDT (Resolved); first update Oct 21, 2026 - 13:54 MDT (Monitoring)", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "status page", "places_checked": [ "search:LoanPro PHP2Shell", "https://loanpro.io/", "https://www.loanpro.io/compliance/", "https://status-loanpro.simnang.com/", "https://status-loanpro.simnang.com/incidents/8pp4lvy410yp", "https://changelog.loanpro.io/ (newest entry October 5, 2026)" ], "last_checked_utc": "2026-10-23T01:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Incident \"PHP2Shell Security Vulnerabilities\". Resolved update: \"Our engineering team has applied permanent patches for the PHP2Shell vulnerabilities across all LoanPro environments.\" quoted from https://status-loanpro.simnang.com/incidents/8pp4lvy410yp. Monitoring update (Oct 21): \"LoanPro is aware of the recently disclosed PHP2Shell security vulnerabilities affecting PHP environments worldwide.\" Interim AWS protections stay in place as an added layer; no customer action required. No CVE number, PHP version, restart or EOL detail given. Separate changelog entry dated June 1, 2026 describes a runtime upgrade from PHP 8.1 to PHP 8.4, predating the incident.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "mach7-technologies", "company": "Mach7 Technologies", "canonical_domain": "mach7t.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Mach7 Technologies PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.mach7t.com/", "https://www.mach7t.com/support", "https://www.mach7t.com/blog (newest October 20, 2026)", "https://www.mach7t.com/blog/imaging-is-one-of-the-few-places-a-rural-hospital-can-still-turn-a-profit (dated October 20, 2026, no PHP content)", "https://www.mach7t.com/investor-relations-posts (newest 28 Aug 2026)" ], "last_checked_utc": "2026-10-23T01:40:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust center or status page linked from the site; support runs through helpdesk.mach7t.com.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "macpractice", "company": "MacPractice", "canonical_domain": "macpractice.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.macpractice.com/", "https://www.macpractice.com/news/", "https://www.macpractice.com/support/" ], "last_checked_utc": "2026-10-23T01:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security or status link in site navigation; news listing undated (one article marked Prepared: September 2026); support page (metadata modified 2026-06-05) has no security advisory.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "maestro-pms", "company": "Maestro PMS", "canonical_domain": "maestropms.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Maestro PMS PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.maestropms.com/ (homepage)", "https://www.maestropms.com/responsible-disclosure-policy.html (disclosure policy, no PHP mention)", "https://www.maestropms.com/press-releases-hospitality-technology-best-hotel-pms-software.html (items undated, none on PHP)", "https://www.maestropms.com/hospitality-technology-blog-hotel-pms-software.html (posts undated, none on PHP)", "https://status.maestropms.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security advisory, trust or status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "managecasa", "company": "ManageCasa", "canonical_domain": "managecasa.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:ManageCasa PHP2Shell", "search:ManageCasa PHP2Shell CVE-2026-109618", "https://www.managecasa.com/", "https://managecasa.com/articles", "https://help.managecasa.com" ], "last_checked_utc": "2026-10-23T00:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security advisory, trust or status page found; the only security link is a product feature section. Newest article 20 October 2026 is about HOA liens. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "manageengine", "company": "ManageEngine", "canonical_domain": "manageengine.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://www.manageengine.com/blog/general/update-on-php-vulnerabilities-cve2026109618-and-cve2026109619.html", "statement_date": "October 22, 2026 (Published and Last updated)", "status": "not affected", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (PHP project fixes cited; no ManageEngine product update needed)", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://www.manageengine.com/security/advisory/ (list loads dynamically, data endpoint returned nothing)", "https://www.manageengine.com/blog/", "https://www.manageengine.com/blog/general/update-on-php-vulnerabilities-cve2026109618-and-cve2026109619.html", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (no ManageEngine entry)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Blog post \"Update on PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619\" (Zoho Corp / ManageEngine): \"ManageEngine products do not use PHP, and none of them are affected by these vulnerabilities.\" and \"A few of our blogs and public static pages are hosted on PHP web servers. These have been updated to the patched PHP versions.\" quoted from the statement URL. Internal PHP services also updated; no customer action required; no evidence of exploitation in its environment.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "manhattan-active-tm", "company": "Manhattan Active TM", "canonical_domain": "manh.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Manhattan Associates PHP2Shell CVE-2026-109618", "https://www.manh.com/", "https://www.manh.com/en-us/news (fetch failed)", "https://www.manh.com/trust-center", "https://www.manh.com/trust-center/security", "https://www.manh.com/about-us/newsroom/press-releases", "https://www.manh.com/about-us/newsroom" ], "last_checked_utc": "2026-10-23T00:21:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trust Center and its security page describe the general program and a vulnerability disclosure program, no advisories; documentation portal trustcenter.manh.com requires access request. Newsroom listing shows no 2026 items. No status page found. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "matomo", "company": "Matomo", "canonical_domain": "matomo.org", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://matomo.org/blog/2026/10/critical-php-security-vulnerabilities-important-update-for-matomo-users/", "statement_date": "October 21, 2026", "status": "patched", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://matomo.org/blog/", "https://matomo.org/blog/2026/10/critical-php-security-vulnerabilities-important-update-for-matomo-users/", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Matomo On-Premise listed Vulnerable citing requirements only)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"Critical PHP Security Vulnerabilities: Important Update for Matomo Users\" names CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Mixed: \"Matomo Cloud customers are already protected. No action is required.\" while On-Premise users must update PHP now and confirm the web server runs the patched version; \"Updating Matomo itself does not resolve these vulnerabilities.\" Both quoted from the statement URL. Users on older PHP told to check with their OS or hosting provider for patches or upgrade to a supported version.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "mautic", "company": "Mautic", "canonical_domain": "mautic.org", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://mautic.org/blog/critical-php-security-release-today-please-get-your-mautic-servers-ready", "statement_date": "October 21, 2026", "status": "customer must update", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.mautic.org/blog", "https://mautic.org/blog/critical-php-security-release-today-please-get-your-mautic-servers-ready", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Mautic listed Vulnerable citing install docs only)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"Critical PHP security release today - please get your Mautic servers ready\" names CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2). Self-hosted admins must update PHP themselves, then restart PHP-FPM or the web server and anything else running PHP such as queue workers; managed instances to ask their host or partner. \"The PHP team is clear that none of them make a server safe, and only updating fixes the problem\" quoted from the statement URL (on the interim settings). Updated Docker images for Mautic 5, 6 and 7 released; Mautic Trials signup removed while that infrastructure is patched. PHP 8.1 and older have no official fixed version; minimal backports for 7.4, 8.0, 8.1 noted; PHP 8.2 reaches end of life 31 Dec 2026.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "mcleod-software", "company": "McLeod Software", "canonical_domain": "mcleodsoftware.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.mcleodsoftware.com/", "https://trust.mcleodsoftware.com/", "https://www.mcleodsoftware.com/why-mcleod/press-releases/" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. Trust center (SOC 2 Type II) has no advisories; no status page or blog linked. Newest press release 5 August 2026. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "mediawiki-wikimedia", "company": "MediaWiki, Wikimedia", "canonical_domain": "mediawiki.org", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.mediawiki.org/wiki/News (fetch failed, url_not_found)", "https://www.mediawiki.org/wiki/MediaWiki (fetch failed)", "https://www.mediawiki.org/w/index.php?search=PHP2Shell+OR+CVE-2026-109618&title=Special%3ASearch (fetch failed)", "https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/ (fetch failed)", "https://techblog.wikimedia.org/ (fetch failed)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (MediaWiki listed Vulnerable citing installation requirements", "Wikimedia application-server PHP tier listed Investigation)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No MediaWiki or Wikimedia Foundation statement could be located: every mediawiki.org and wikimedia.org page tried in this run failed to load, so this row is unverified rather than confirmed absent. NCSC-NL inventory lists MediaWiki as Vulnerable on the basis of PHP requirements, not a project statement. Synology's 22 Oct 2026 statement lists its MediaWiki package among affected PHP-dependent packages.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "medinformatix", "company": "MedInformatix", "canonical_domain": "medinformatix.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:MedInformatix PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.medinformatix.com/", "https://www.medinformatix.com/company.html (News section lists no articles)", "https://www.medinformatix.com/contact/Support.html (renders a demo request page)" ], "last_checked_utc": "2026-10-23T01:40:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust, status, blog or populated news page on the site; SOC 2 badge links to an AICPA page.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "merative-merge", "company": "Merative (Merge)", "canonical_domain": "merative.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Merative Merge PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.merative.com/", "https://www.merative.com/newsroom (newest item the September 2026 Merge Community Snapshot)", "https://www.merative.com/support", "https://www.merge.com/services-and-support" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust, security bulletin or status page linked from merative.com or merge.com.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "meridianlink", "company": "MeridianLink", "canonical_domain": "meridianlink.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:MeridianLink PHP2Shell", "https://www.meridianlink.com/", "https://www.meridianlink.com/security-and-trust/", "https://www.meridianlink.com/newsroom/ (newest item 8 October 2026)", "https://www.meridianlink.com/blog/ (posts undated)", "https://status.meridianlink.com/ (incidents and maintenance 19 to 22 October 2026 read)" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page carries scheduled security maintenance for EPL and Dedicated production environments (notice posted 20 October, window 22 to 23 October 2026) whose stated purpose is to \"install the MS security patch for the current month\" (quoted from https://status.meridianlink.com/). That notice is about a Microsoft patch; no mention of PHP, PHP2Shell or the CVEs anywhere on the status page.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "meruscase", "company": "MerusCase", "canonical_domain": "meruscase.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:MerusCase PHP2Shell", "https://www.meruscase.com/", "https://legal.meruscase.com/vulnerability-reporting-policy", "http://blog.meruscase.com (newest post January 31, 2023)" ], "last_checked_utc": "2026-10-23T00:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page or newsroom linked from the homepage. Vulnerability Reporting Policy page is a generic researcher policy with no advisory content.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "mews", "company": "Mews", "canonical_domain": "mews.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": true, "statement_url": "https://status.mews.com/incidents/zk5wtj3dll3d", "statement_date": "Posted Oct 22, 2026 - 00:33 CEST (resolved); first update Posted Oct 21, 2026 - 14:34 CEST", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "status page", "places_checked": [ "search:Mews PHP2Shell", "https://www.mews.com/ (homepage)", "https://www.mews.com/en/security-at-mews (security page, no PHP mention)", "https://trust.mews.com/ (trust center, no PHP mention)", "https://status.mews.com/ (status page, incident found)", "https://status.mews.com/incidents/zk5wtj3dll3d (incident permalink, read in full)", "https://www.mews.com/en/blog (posts undated)", "https://releases.mews.com/en (release notes, entries not captured)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Incident \"Critical 0 day PHP vulnerability\". Investigating, Posted Oct 21, 2026 - 14:34 CEST: \"We are aware of reports of a newly disclosed critical (zero-day) vulnerability affecting PHP 5.4+.\" Resolved, Posted Oct 22, 2026 - 00:33 CEST: \"In response to the Critical PHP Vulnerability announced today, all potentially impacted instances were patched.\" quoted from https://status.mews.com/incidents/zk5wtj3dll3d. Intermediate updates (16:02 and 17:14 CEST, Oct 21) say protective measures were added and no evidence of customer data or service impact. Does not name PHP2Shell or the CVE numbers; no fixed version, restart or EOL detail; affected components not named.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "microsoft-azure-app-service", "company": "Microsoft Azure App Service", "canonical_domain": "azure.microsoft.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://azure.github.io/AppService/2026/10/21/php-critical-security-release-app-service-linux.html", "statement_date": "October 21, 2026", "status": "patched partly", "fixed_version_named": "yes: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://azure.github.io/AppService/", "https://azure.github.io/AppService/2026/10/21/php-critical-security-release-app-service-linux.html", "https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623 (body did not render in fetch)", "search:site:microsoft.com CVE-2026-109618 PHP App Service", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:35:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "We have completed the rollout of the updated built-in PHP images with the security fixes.", "notes": "\"We have completed the rollout of the updated built-in PHP images with the security fixes.\" (Latest and Standard Platform Release Channels) and \"If you run PHP in a custom container, or bring your own PHP runtime, App Service does not patch it.\" quoted from https://azure.github.io/AppService/2026/10/21/php-critical-security-release-app-service-linux.html (Azure App Service team blog; authors Tulika Chaudharie, Byron Tardif; title: Critical PHP Security Release: What It Means for Azure App Service on Linux). Customers on the Extended channel told to move off it; \"End-of-life (EOL) PHP versions will not receive these security patches.\"; WordPress on App Service updated except older Alpine-based images: \"The older Alpine-based images will not receive these security patches.\" A second Microsoft post exists at techcommunity.microsoft.com (Azure Network Security Blog, modified 2026-10-22T10:26:20-07:00, title: Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade guidance and Azure WAF mitigations) whose body did not render in fetch.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "microsoft-dynamics-365", "company": "Microsoft Dynamics 365", "canonical_domain": "microsoft.com", "group": "index_vendor", "index_category": "crm", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623", "search:Microsoft PHP2Shell", "https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623 (Azure Network Security Blog post, body renders by script, only title and opening read)", "https://msrc.microsoft.com/blog/ (302 redirect to https://www.microsoft.com/en-us/msrc/blog, no PHP post)", "https://azure.status.microsoft/en-us/status/history/ (Azure status history, no entries dated 20 to 23 October 2026, no PHP mention)" ], "last_checked_utc": "2026-10-23T02:03:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Microsoft published a Tech Community post on PHP2Shell upgrade guidance and Azure WAF mitigations (page metadata modified 2026-10-22) at https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623; it is customer guidance for Azure workloads and says nothing specific to Dynamics 365, so no Dynamics 365 statement is recorded. The post body loads by script and was not read in full. Post titled \"Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade guidance and Azure WAF mitigations\" on Microsoft's Tech Community; readable opening: \"Today, two critical remote code execution (RCE) vulnerabilities were disclosed in PHP.\" quoted from the statement URL. Only the title and opening could be read (body loads by script), so the status rests on the title's own words (Azure WAF mitigations plus customer upgrade guidance) and should be rechecked in a full read. No date printed; page metadata modified_time 2026-10-22T10:26:20-07:00. Nothing found specific to Dynamics 365.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "milesweb", "company": "MilesWeb", "canonical_domain": "milesweb.com", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.milesweb.com/blog/ (no PHP post", "page shows undated older posts)", "https://www.milesweb.com/ (fetch failed, client_error, twice)", "https://status.milesweb.com/ (fetch failed, client_error)", "https://www.milesweb.com/kb/ (fetch failed, client_error)", "https://www.milesweb.in/ (fetch limit, retry next hour)", "search:MilesWeb PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:35:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Blog shows no PHP2Shell post; homepage, status and knowledge-base pages returned client errors to the fetcher, so a notice there cannot be excluded. The compilation pages list MilesWeb with no statement found (reported by activeset.co 22 Oct 2026).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "monday-com", "company": "monday.com", "canonical_domain": "monday.com", "group": "index_vendor", "index_category": "project_management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:monday.com PHP2Shell", "https://monday.com/trustcenter (trust center, no PHP or CVE mention)", "https://trust.monday.com/ (Security Compliance Hub, updates undated, newest vulnerability response concerns CVE-2025-55182, no PHP item)", "https://status.monday.com/ (status page)" ], "last_checked_utc": "2026-10-23T02:16:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for Oct 20 and Oct 21 and \"No incidents reported today.\" for Oct 22, 2026, quoted from https://status.monday.com/. The Compliance Hub carries an earlier \"unaffected\" response for a React CVE but nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "moodle", "company": "Moodle", "canonical_domain": "moodle.org", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://moodle.org/mod/forum/discuss.php?d=482882", "statement_date": "Thursday, 22 October 2026, 2:11 AM", "status": "patching", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://moodle.org/news/ (listing shows the full post)", "https://moodle.org/mod/forum/discuss.php?d=482882 (direct read returned a captcha challenge page)", "https://moodle.org/security/ (newest MSA-26-0045 15 Oct 2026, nothing on PHP2Shell)", "https://moodle.org/mod/forum/view.php?id=7128", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Moodle listed Vulnerable citing release docs only)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"Update on Moodle's Response to the PHP2SHELL vulnerability for our public facing sites\" by Amy Tessitore (Moodle HQ) on moodle.org: HQ took its public-facing sites offline as a precaution on 21 Oct 2026, has patched its own site and is deploying and validating patches on its other public-facing and client sites. \"Unpatched sites remain vulnerable to potential exploits related to PHP2SHELL.\" quoted from https://moodle.org/mod/forum/discuss.php?d=482882. Self-hosted sites told to \"create a plan to update your PHP with the released security patches, immediately.\" No CVE numbers, no PHP versions, no MoodleCloud mention.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Moodle affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Moodle sites running vulnerable PHP are affected, and patches are available. The fix is to PHP, not simply an update to Moodle’s application code. Moodle explicitly warns that unpatched sites remain vulnerable. Patch status as of October 23, 2026: Moodle.org: Moodle HQ’s October 22 announcement confirms: “We have patched this site and brought it back online.” Other Moodle-managed sites:", "cited_urls": [ "https://www.php.net/archive/2026.php", "https://moodle.org/news/?lang=en" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Moodle affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on the search results, here is a thorough answer about Moodle's relationship to PHP2Shell: Is Moodle Affected by PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? Yes — Because the Vulnerability Is in PHP Itself, Not the Application The critical point is that PHP2Shell does not target application-level code in platforms like Moodle. PHP2Shell refers to two CRITICAL-severity PHP core vulnerabilities (CVE-2026-109618,", "cited_urls": [ "https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/", "https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/", "https://scantitan.com/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://en.wikipedia.org/wiki/PHP2Shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Moodle affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Moodle is affected indirectly because PHP2Shell vulnerabilities are in the PHP runtime, not in Moodle itself. Any Moodle site running an affected, web-facing PHP version is exposed; updating Moodle alone does not remediate it. PHP released fixes on October 21, 2026 in: PHP 8.2.35 PHP 8.3.36 PHP 8.4.27 PHP 8.5.12 Therefore, Moodle is patched only when the server’s", "cited_urls": [ "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://wz-it.com/en/blog/php-vulnerabilities-cve-2026-109618-109619-affected-software-measures/", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell", "https://rimuhosting.com/maintenance.jsp?server_maint_oid=8221642932", "https://github.com/0xDTC/0xPHP2SHELL-Impact-Analysis/blob/master/Readme.md", "https://sansec.io/research/php2shell", "https://en.wikipedia.org/wiki/PHP2Shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:33.102Z", "question": "Is Moodle affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Moodle is affected indirectly because it runs on PHP, and Moodle HQ has already applied security patches to its hosted infrastructure. Impact and Patch Status The Vulnerability: CVE-2026-109618 and CVE-2026-109619 (\"PHP2Shell\") are critical RCE flaws located inside the core PHP engine rather than Moodle's own application code. Any platform running on an unexposed or unpatched PHP version is", "cited_urls": [ "https://moodle.org/mod/forum/discuss.php?d=482882", "https://tuchsoft.com/guides-and-articles/php-critical-vulnerability-october-2026/", "https://moodleus.statuspage.io/", "https://www.wiz.io/blog/php2shell-php-rce", "https://sansec.io/research/php2shell", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching", "https://www.facebook.com/moodle/posts/as-a-precautionary-measure-in-response-to-the-php2shell-vulnerability-which-was-/1571864764968591/", "https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Moodle affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact: Yes, Moodle platforms run on PHP and were affected by the PHP2SHELL vulnerabilities (CVE-2026-109618 and CVE-2026-109619). As a precautionary measure, Moodle HQ temporarily took their public-facing sites offline when the vulnerability details were made public. Patch Status: Patches and updates have been released and deployed by Moodle HQ for their managed infrastructure, and they are continuing validation across", "cited_urls": [ "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/", "https://moodle.org/mod/forum/discuss.php?d=482882" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "mortgage-cadence", "company": "Mortgage Cadence", "canonical_domain": "mortgagecadence.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Mortgage Cadence PHP2Shell", "https://www.mortgagecadence.com/", "https://www.mortgagecadence.com/news/ (newest April 21, 2026)", "https://www.mortgagecadence.com/blog/ (newest June 30, 2026)" ], "last_checked_utc": "2026-10-23T01:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page linked from the site; support documentation sits behind a login.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "mortgageflex", "company": "MortgageFlex", "canonical_domain": "mortgageflex.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:MortgageFlex PHP2Shell", "https://www.mortgageflex.com/", "https://www.mortgageflex.com/news (newest Oct 12, 2026)", "https://www.mortgageflex.com/story" ], "last_checked_utc": "2026-10-23T01:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust, status or blog page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "motility-software", "company": "Motility Software", "canonical_domain": "motilitysoftware.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.motilitysoftware.com/", "https://blog.motilitysoftware.com", "https://www.motilitysoftware.com/resources/news-and-events" ], "last_checked_utc": "2026-10-23T01:09:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust or status link in site navigation; blog newest post September 16, 2026; news newest item 2026-10-02 (events).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "msp360", "company": "MSP360", "canonical_domain": "msp360.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://www.msp360.com/resources/blog/php2shell-vulnerabilities-not-affected/", "statement_date": "October 22, 2026", "status": "not affected", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (PHP project fixes cited; MSP360 products need no update)", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.msp360.com/resources/blog/php2shell-vulnerabilities-not-affected/", "search:MSP360 PHP2Shell (statement URL supplied by desk)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (no MSP360 entry)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post states \"MSP360 products do not use PHP and are not affected by the recently disclosed PHP2Shell vulnerabilities\" (CVE-2026-109618 and CVE-2026-109619); no product updates, configuration changes or other actions needed; \"Customers can continue using MSP360 software as usual.\" On other systems: \"Patching does not remove backdoors an attacker may already have installed.\" and \"Older PHP versions may require updates from operating system vendors or migration to a supported release.\" All quoted from the statement URL.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "nagios", "company": "Nagios", "canonical_domain": "nagios.org", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.nagios.com/news/ (index last updated March 2026, nothing on PHP2Shell)", "https://www.nagios.com/security/ (404)", "https://www.nagios.com/changelog/", "https://www.nagios.com/changelog/nagios-xi/ (newest 2026R2, 23 Sep 2026, nothing on PHP2Shell)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Nagios XI configuration-wizard subsystem and Nagios Fusion listed Vulnerable citing a development guide only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Nagios Enterprises statement on PHP2Shell found in news or changelogs as of the last check. NCSC-NL inventory lists Nagios XI and Nagios Fusion web components as Vulnerable on the basis of product documentation, not a vendor statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "namecheap", "company": "Namecheap", "canonical_domain": "namecheap.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "statement_date": "Update @ 9:33 AM EDT | 13:33 UTC, October 22 (latest; initial post October 21, 09:31 AM America/New_York)", "status": "patching", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "status page", "places_checked": [ "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "The fix has been successfully implemented on all other servers.", "notes": "\"The fix has been successfully implemented on all other servers.\" (still in progress: Regular servers 71, 72, 105, 312; Update @ 9:33 AM EDT | 13:33 UTC, October 22) quoted from https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/ (title: [UPDATED] PHP Security Vulnerability affecting Hosting Services | October 21, 2026). Mitigations on all platforms; patched versions came via CloudLinux repositories; VPS and dedicated server owners told to update PHP themselves. A navigation link refers to a completed EasyWP PHP security maintenance (not read).", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Namecheap affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Namecheap confirmed its PHP hosting services were affected, and now reports that patching is complete. As checked on October 23, 2026, its official incident notice is marked [RESOLVED]. Affected: Namecheap identified PHP-based websites and applications across its hosting platforms as affected by CVE-2026-109618 and CVE-2026-109619. Patched: Following initial mitigations and a staged rollout, the notice’s 12:50 p.m. EDT completion", "cited_urls": [ "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Namecheap affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes — Namecheap is affected by PHP2Shell, has acknowledged it publicly, and is actively patching. Here is a full breakdown with sources: What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code on a web server without logging in. The PHP security team rates", "cited_urls": [ "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.security.com/blog-post/php2shell-critical-vulns-cve-2026-109618-109619", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://www.namecheap.com/status-updates/", "https://meowapps.com/php2shell-wordpress/", "https://www.activeset.co/blog/php2shell-host-status", "https://x.com/Namecheap/status/2112965989931373046" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Namecheap affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Namecheap was affected: its status notice says the vulnerabilities affected websites and applications running PHP on all versions and platforms. Patch status: Namecheap initially applied mitigations while awaiting PHP’s official fixes. After PHP released patched versions, Namecheap deployed them across its hosting infrastructure; its incident was subsequently marked resolved. Namecheap also reported that remaining server deployments were completed,", "cited_urls": [ "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://www.namecheap.com/status-updates/", "https://php2shellcheck.com/hosting-status/", "https://x.com/Namecheap/status/2112965989931373046", "https://www.namecheap.com/status-updates/category/hosting/dedicated-servers/", "https://www.namecheap.com/status-updates/category/hosting/vps/", "https://meowapps.com/php2shell-wordpress/", "https://www.namecheap.com/status-updates/category/hosting/", "https://github.com/NCSC-NL/php2shell", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Namecheap affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: Yes, Namecheap's hosting services (including Dedicated Servers, Shared Servers, Reseller Servers, VPS, and general hosting platforms running PHP) were affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Patch Status: Namecheap has marked the security incident as [RESOLVED] on their status page following PHP's release of patched versions (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35). Source: You can read", "cited_urls": [ "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://tuxcare.com/blog/php2shell-cve/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Namecheap affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Namecheap's hosting services were affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which impact websites and applications running PHP on all platforms. Status: Resolved / Mitigated Namecheap Action: Namecheap put mitigation measures in place across all of their hosting platforms (including Shared, Dedicated, Reseller, VPS, and Hosting servers) to reduce the risk of exploitation while waiting for official", "cited_urls": [ "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "nasa-eclipse", "company": "NASA (Eclipse)", "canonical_domain": "nasasoft.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:NASA Eclipse insurance software PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.nasasoft.com/ (homepage", "no security or status link)", "https://www.nasasoft.com/blog (newest post Jul 02, 2025)", "https://www.nasasoft.com/security (fetch failed, client error)", "https://status.nasasoft.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page linked from the site; blog last updated July 2025.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "navetor", "company": "NaVetor", "canonical_domain": "navetor.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.navetor.com/", "https://www.navetor.com/blog", "https://www.navetor.com/support" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or status page on navetor.com (Patterson product). Newest blog post dated October 2026 (no day) is about practice data access. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ncino", "company": "nCino", "canonical_domain": "ncino.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:nCino PHP2Shell", "https://www.ncino.com/", "https://www.ncino.com/ncino-trust (Trust Commitment page)", "https://www.ncino.com/security (fetch failed: client_error)", "https://trust.ncino.com/ (fetch failed: robots_disallowed)", "https://www.ncino.com/news (listing rendered without items)", "https://www.ncino.com/api/markdown/sitemap", "https://www.ncino.com/news/ncino-introduces-digital-partners-role-based-agents (dated November 4, 2025)" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trust Commitment page lists certifications and practices only; no advisory content. News listing did not render items on fetch; sitemap shows no URL mentioning PHP, CVE or a security advisory.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "netlify", "company": "Netlify", "canonical_domain": "netlify.com", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.netlifystatus.com/ (no PHP incident 20 to 22 Oct 2026)", "https://www.netlify.com/blog/ (newest post 29 Sep 2026)", "https://www.netlify.com/security/ (no notice)", "https://trust.netlify.com/ (fetch limit, retry next hour)", "search:Netlify PHP2Shell OR CVE-2026-109618 (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Nothing found on the status page, blog or security page. The compilation pages also list Netlify with no statement found (reported by activeset.co 22 Oct 2026: no statement found). Trust center not yet read because of the fetch limit.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "nexcess", "company": "Nexcess", "canonical_domain": "nexcess.net", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://status.nexcess.com/incidents/n4fpf22f5xtf", "statement_date": "Oct 21, 2026 - 22:09 EDT (latest; first Oct 21, 2026 - 09:27 EDT)", "status": "patching", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; cPanel vendor backports 8.1.34-5, 8.0.30-12, 7.4.33-19; Plesk 18.0.81.4", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://status.nexcess.com/", "https://status.nexcess.com/incidents/n4fpf22f5xtf", "search:Nexcess PHP2Shell OR CVE-2026-109618", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:38:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Our Engineering teams are actively working to deploy patched PHP builds across our hosting infrastructure.", "notes": "\"Our Engineering teams are actively working to deploy patched PHP builds across our hosting infrastructure.\" quoted from https://status.nexcess.com/incidents/n4fpf22f5xtf (title: PHP Security Vulnerability Assessment (CVE-2026-109618 & CVE-2026-109619)). No completion notice at this check; same wording as sister brand Liquid Web. Customers told to verify patch status and, if unpatched, run a package update through their control panel; EOL PHP sites told to move to a supported version.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Nexcess affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Nexcess lists affected services, and patching is underway—but it has not confirmed that all environments are patched. As checked on October 23, 2026, its latest official update is dated October 22, 2026, at 15:27 EDT. Affected: Nexcess’s incident for both CVEs lists Cloud Dedicated, Cloud VPS Hosting, cPanel, InterWorx, and Plesk. This does not establish that every customer site", "cited_urls": [ "https://status.nexcess.com/incidents/n4fpf22f5xtf" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Nexcess affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "I was unable to find any Nexcess-specific advisory, blog post, or statement addressing PHP2Shell (CVE-2026-109618 / CVE-2026-109619). There is no publicly available source confirming whether Nexcess has or has not patched this vulnerability on its platform, or issued guidance to its customers. You should contact Nexcess support directly for an authoritative answer. That said, here is what is known", "cited_urls": [ "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://vercel.com/kb/bulletin/php2shell-security-bulletin", "https://github.com/NCSC-NL/php2shell", "https://sansec.io/research/php2shell", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://en.wikipedia.org/wiki/PHP2Shell", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/" ], "names_status": true, "status_named": "no public statement located", "matches_statement": false, "cites_company_page": false, "says_no_statement": true, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Nexcess affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Nexcess was affected where its infrastructure was running vulnerable PHP versions, because PHP2Shell affects PHP installations serving web requests, including PHP-FPM and Apache/mod_php. The fixed upstream PHP versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Nexcess reported on October 22, 2026 that most affected hosts had been patched and patching was still underway on the remaining hosts. Therefore, Nexcess", "cited_urls": [ "https://php2shellcheck.com/hosting-status/", "https://github.com/hkoeck/php2shell-status", "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:18:09.009Z", "question": "Is Nexcess affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Nexcess was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and its security and engineering teams have rolled out patches across their hosting environments. Status & Patch Details Affected Systems: Nexcess infrastructure running PHP versions 5.4 and later was initially exposed to the critical RCE flaws. Patch Status: Nexcess has rolled out fixes across the majority of their", "cited_urls": [ "https://status.nexcess.net/", "https://status.nexcess.com/", "https://www.reddit.com/r/webhosting/comments/1xc4wzj/php2shell_some_shared_hosts_still_havent_patched/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Nexcess affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Nexcess is affected by PHP2Shell, and they have begun patching their hosting environments. Because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) impacts the core PHP engine itself (affecting versions 5.4 and later), all managed hosting environments running PHP are inherently vulnerable until updated. According to the official Nexcess Status Page, their security and engineering teams identified the threat on October 21,", "cited_urls": [ "https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell", "https://status.nexcess.com/", "https://status.nexcess.net/", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null } ] }, { "slug": "nextagency", "company": "NextAgency", "canonical_domain": "nextagency.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:NextAgency PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.nextagency.com/ (homepage", "no status or blog link)", "https://nextagency.com/security/ (security page, no PHP or CVE mention)", "https://nextagency.com/nextagency-changelog/ (newest entry October 7, 2026, no PHP mention)", "https://status.nextagency.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "nextcloud", "company": "Nextcloud", "canonical_domain": "nextcloud.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://github.com/nextcloud/server/issues/65754", "statement_date": "Oct 21, 2026", "status": "mitigation only", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://github.com/nextcloud/server/issues/65754 (read twice, 00:20Z and 01:20Z)", "https://nextcloud.com/blog/ (newest post 16 Oct 2026, nothing on PHP2Shell)", "https://nextcloud.com/security/ (no PHP2Shell content)", "https://help.nextcloud.com/c/news/announcements/14 (nothing relevant)", "search:Nextcloud PHP2Shell (no relevant result)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Nextcloud Server listed Vulnerable citing issue 65754 and commit ba900af)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Pinned issue \"PHP CVEs. Attention required!\" opened 21 Oct 2026 by Nextcloud staff (kesselb) on the project's official GitHub repository, not on nextcloud.com; no further comments or edits as of the second read. \"We have been informed by CERT of an issue affecting PHP.\" and \"We will release an update as soon as more information is known about affected PHP versions and availability of updates.\" quoted from https://github.com/nextcloud/server/issues/65754. The post relays CERT's recommendation to turn off servers running PHP-based applications until PHP updates are available and applied; it names no CVE, no fixed PHP version, no restart or EOL guidance and no rebuilt image. Status reflects that only a take-offline measure is stated.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Nextcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Nextcloud deployments running vulnerable PHP are affected, and a patched Nextcloud AIO release is available. As of October 23, 2026, Nextcloud’s official warning confirms that the PHP issues affect Nextcloud and could allow server compromise and access to its data. The patch status depends on how you run Nextcloud: | Deployment | Patch status / required action | |---|---|", "cited_urls": [ "https://github.com/nextcloud/server/issues/65754?utm_source=openai", "https://github.com/nextcloud/all-in-one/releases/tag/v14.4.1", "https://www.php.net/archive/2026.php", "https://github.com/nextcloud/all-in-one/issues/8876" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Nextcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Nextcloud is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and a patch has been released. Here is a full breakdown: What is PHP2Shell? PHP2Shell refers to a set of memory-safety vulnerabilities in the core PHP engine, grouped under CVE-2026-109618 and CVE-2026-109619, publicly disclosed on 21 October 2026. The PHP security team rates both CVSSv4.0 9.2 and says they can", "cited_urls": [ "https://security.truenas.com/scale/impact-statements/php2shell-2026/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://github.com/nextcloud/all-in-one/issues/8876", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Nextcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Nextcloud is affected when it runs on a vulnerable PHP runtime, because PHP2Shell is a flaw in PHP itself—not in Nextcloud code. Reports identify Nextcloud among applications exposed to pre-authentication code execution on affected PHP versions. Patch status: Self-hosted/system PHP: Nextcloud does not bundle or patch the host’s PHP runtime. Upgrade PHP to at least 8.2.35, 8.3.36, 8.4.27,", "cited_urls": [ "https://help.nextcloud.com/t/php-vulnerability-issue/251257", "https://help.nextcloud.com/t/is-nextcloud-susceptible-to-the-php2shell-attack/251255/5", "https://security.truenas.com/scale/impact-statements/php2shell-2026/", "https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html", "https://mallory.ai/blog/php-rce-rapid-response", "https://wz-it.com/en/blog/php-vulnerabilities-cve-2026-109618-109619-affected-software-measures/", "https://github.com/hkoeck/php2shell-status", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://bifrostsec.com/blog/2026/php2shell-security-advisory/", "https://github.com/NCSC-NL/php2shell" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Nextcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Nextcloud itself is not vulnerable by its own application code, but Nextcloud servers are affected if they run on a vulnerable version of PHP. Are Nextcloud servers affected? The Flaw: PHP2Shell (CVE-2026-109618 and CVE-2026-109619 ) is a vulnerability in the PHP language engine/runtime, not Nextcloud's codebase. Impact: Any web application running on an unpatched PHP version—including Nextcloud, WordPress, and", "cited_urls": [ "https://help.nextcloud.com/t/is-nextcloud-susceptible-to-the-php2shell-attack/251255", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://www.cycognito.com/blog/emerging-threat-php2shell-cve-2026-109618-109619/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://labs.beazley.security/advisories/BSL-A1233" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Nextcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Nextcloud is implicitly affected because Nextcloud is built on PHP and relies on the underlying PHP runtime environment. The \"PHP2Shell\" vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reside in the PHP core language runtime itself, meaning any application-level software running on an unpatched PHP version is exposed to unauthenticated remote code execution (RCE). Impact and Status Vulnerability Nature: These critical core", "cited_urls": [ "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://help.nextcloud.com/t/is-nextcloud-susceptible-to-the-php2shell-attack/251255", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "https://help.nextcloud.com/t/new-master-container-for-aio-to-fix-php2shell/251284", "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "nimble", "company": "Nimble", "canonical_domain": "nimble.com", "group": "index_vendor", "index_category": "crm", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Nimble CRM PHP2Shell", "https://www.nimble.com/ (homepage, no security, trust or status link, no notice)", "https://status.nimble.com/ (fetch failed, robots disallowed)", "https://www.nimble.com/whats-new/ (product updates, undated, none on PHP)" ], "last_checked_utc": "2026-10-23T02:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from nimble.com. No PHP2Shell item found.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "nortridge", "company": "Nortridge", "canonical_domain": "nortridge.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Nortridge PHP2Shell", "https://www.nortridge.com/", "https://nortridge.com/category/blog/ (posts undated)", "https://nortridge.com/support-and-training/" ], "last_checked_utc": "2026-10-23T01:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust, status or news page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "notion", "company": "Notion", "canonical_domain": "notion.com", "group": "index_vendor", "index_category": "project_management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Notion PHP2Shell", "https://www.notion.com/security (security page, no PHP or CVE mention)", "https://trust.notion.com/ (trust center, Latest Updates list did not render, no PHP mention)", "https://www.notion-status.com/ (status page, one undated notice \"Security update: Preventative certificate security measures\", no PHP mention)", "https://www.notion.com/releases (newest release October 19, 2026, none on PHP)" ], "last_checked_utc": "2026-10-23T02:17:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "The only status notice concerns preventative certificate and certificate-bundle updates and does not mention PHP or PHP2Shell (https://www.notion-status.com/).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "novarad", "company": "Novarad", "canonical_domain": "novarad.net", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Novarad PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.novarad.net/", "https://www.novarad.net/en-us/compliance-documentation", "https://www.novarad.net/news (newest 2 October 2026)", "https://blog.novarad.net (newest Oct 2, 2026)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Compliance page describes a general process including \"immediate communication and deployment of patches to affected customers\" (quoted from https://www.novarad.net/en-us/compliance-documentation); no specific advisory. No status page located.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "nowcerts", "company": "NowCerts", "canonical_domain": "nowcerts.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:NowCerts PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.nowcerts.com/ (homepage", "script-rendered, only metadata readable)", "https://www.nowcerts.com/blog (only metadata readable)", "https://www.nowcerts.com/security (only metadata readable)", "https://www.nowcerts.com/news (only metadata readable)", "https://status.nowcerts.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Site is script-rendered; no page text beyond metadata could be read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "odoo", "company": "Odoo", "canonical_domain": "odoo.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.odoo.com/security (no PHP2Shell content)", "https://www.odoo.com/blog/odoo-news-5 (no PHP2Shell content)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (no Odoo entry)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Odoo statement on PHP2Shell found on its security page or news blog as of the last check. Odoo does not appear in the NCSC-NL inventory.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "onepacs", "company": "OnePACS", "canonical_domain": "onepacs.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:OnePACS PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.onepacs.com/", "https://onepacs.com/support/", "https://onepacs.com/blog/ (posts undated)" ], "last_checked_utc": "2026-10-23T01:40:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust, status or news page linked from the site; support runs through help.onepacs.com (login).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "onward-vet", "company": "Onward Vet", "canonical_domain": "onwardvet.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.onwardvet.com/", "https://onwardvet.com/news/", "https://onwardvet.com/news/2026-cloud-review/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or status page; news items undated. The post 2026 Cloud Security Review Completed (page modified 5 January 2026) describes an internal review and does not mention PHP or any CVE. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "open-dental", "company": "Open Dental", "canonical_domain": "opendental.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.opendental.com/", "https://www.opendental.com/site/announcements.html", "https://opendental.blog/", "https://www.opendental.com/site/versions.html" ], "last_checked_utc": "2026-10-23T01:14:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Customer announcements newest 09/16/2026 (eClipboard iOS issue); blog newest post October 20, 2026 (dental anxiety topic); versions page newest 26.2 and 26.1 dated 08/06/2026; no PHP mention anywhere.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "openemr", "company": "OpenEMR", "canonical_domain": "open-emr.org", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://github.com/openemr/openemr/pull/14773", "statement_date": "Oct 22, 2026 (opened and merged)", "status": "patched", "fixed_version_named": "yes: OpenEMR docker/binary image rebuilt on PHP 8.5.12 (binary release 10212026; OpenEMR stays 8.4.1)", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://github.com/openemr/openemr/pull/14773", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (OpenEMR listed Fix citing this PR and the docker/binary README)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Merged pull request \"chore(docker): bump binary image to PHP 8.5.12 forge release\" (#14773) on the project's official GitHub repository, by Jmevorach, merged by maintainer bradymiller on 22 Oct 2026: \"PHP shipped 8.5.12 today with the fixes for the PHP2Shell bugs (CVE-2026-109618 and CVE-2026-109619).\" and \"The current pin (10032026) ships PHP 8.5.11, which is vulnerable.\" quoted from the PR URL. Covers the official binary Docker image (Alpine images handled in #14771); no statement for other install types was read, and the project forum was not checked.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "opnsense", "company": "OPNsense", "canonical_domain": "opnsense.org", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://forum.opnsense.org/index.php?topic=53191.msg276103", "statement_date": "October 21, 2026, 09:04:08 PM", "status": "patched", "fixed_version_named": "yes: OPNsense Community Edition 26.7.7 (PHP 8.5.12) and Business Edition 26.4.2p3 (PHP 8.3.36)", "workers_restart_stated": "yes", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://forum.opnsense.org/index.php?topic=53191.msg276103", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (OPNsense WebGUI and API listed Fix citing this announcement and the 26.7 release notes)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Forum announcement \"PHP2Shell (CVE-2026-109618 en CVE-2026-109619): OPNsense 26.7.7 / 26.4.2p3\" by AdSchellevis (Administrator, Deciso) on the official OPNsense forum. \"We have just released a hotfix for both the OPNsense Community Edition (26.7.7) and Business Edition (26.4.2p3)\" and \"Users running the captive portal are advised to restart their captive portal service after installing the update\" quoted from the statement URL. Older releases not mentioned.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "oracle-construction-and-engineering", "company": "Oracle Construction and Engineering", "canonical_domain": "oracle.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Oracle PHP2Shell CVE-2026-109618 statement", "https://www.oracle.com/security-alerts/", "https://blogs.oracle.com/security/" ], "last_checked_utc": "2026-10-23T00:24:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Oracle Security Alerts page newest entries are Security Alert for CVE-2026-91403 (21 October 2026) and Critical Patch Update - October 2026 (20 October 2026); neither listing mentions PHP, CVE-2026-109618 or CVE-2026-109619.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "oracle-opera-cloud", "company": "Oracle OPERA Cloud", "canonical_domain": "oracle.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Oracle OPERA Cloud PHP2Shell", "search:Oracle Linux PHP CVE-2026-109618 errata", "https://www.oracle.com/security-alerts/ (newest: Critical Patch Update - October 2026, 20 October 2026", "Alert for CVE-2026-91403, 21 October 2026)", "https://www.oracle.com/security-alerts/cpuoct2026.html (released 2026-October-20", "no PHP, PHP2Shell or PHP CVE mention in the text read", "lists Oracle Hospitality OPERA 5 Property Services among affected Oracle products)", "https://www.oracle.com/security-alerts/alert-CVE-2026-91403.html (21 October 2026, Java SE and GraalVM JSSE certificate alert, no PHP mention)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Oracle's October 2026 Critical Patch Update (20 October 2026) and the 21 October 2026 Security Alert address Oracle's own products and do not mention PHP or the PHP CVEs. No Oracle Hospitality OPERA Cloud statement on PHP located.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "oracle-transportation-management", "company": "Oracle Transportation Management", "canonical_domain": "oracle.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": true, "statement_url": "https://linux.oracle.com/cve/CVE-2026-109618.html", "statement_date": "2026-10-21", "status": "customer must update", "fixed_version_named": "yes: Oracle Linux 9 php 8.0.30-8.el9_8.1 (ELSA-2026-87151); further php errata ELSA-2026-87070, 87071 (Oracle Linux 10), 87072, 87079 (Oracle Linux 9), 87073, 87080 (Oracle Linux 8)", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "search:Oracle PHP2Shell CVE-2026-109618 security alert", "search:Oracle Linux ELSA php CVE-2026-109618 CVE-2026-109619", "https://www.oracle.com/security-alerts/", "https://blogs.oracle.com/security/", "https://www.oracle.com/security-alerts/cpuoct2026.html", "https://linux.oracle.com/errata/", "https://linux.oracle.com/cve/CVE-2026-109618.html", "https://linux.oracle.com/errata/ELSA-2026-87151.html", "https://linux.oracle.com/errata/ELSA-2026-87080.html (fetch failed)" ], "last_checked_utc": "2026-10-23T00:21:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Statement is Oracle Linux package errata, not a statement about Oracle Transportation Management or Oracle Cloud services. Oracle Linux CVE page: \"Release Date: 2026-10-21\", \"Impact: Important\", listing php errata for Oracle Linux 8, 9 and 10 dated 2026-10-21 and 2026-10-22. ELSA-2026-87151 (\"php security update\", SECURITY, IMPORTANT, Release Date 2026-10-21) lists CVE-2026-109618 and CVE-2026-109619 with the fix line \"Avoid state corruption via bailout\", quoted from https://linux.oracle.com/errata/ELSA-2026-87151.html. Customers install the updated packages. Oracle Security Alerts page (Critical Patch Update 20 October 2026, Security Alert CVE-2026-91403 21 October 2026) and Oracle security blog do not mention PHP. CPU October 2026 page read to 100,000 of 142,028 characters; no PHP mention in the part read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "origence", "company": "Origence", "canonical_domain": "origence.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Origence PHP2Shell", "https://www.origence.com/", "https://origence.com/security-and-compliance/", "https://origence.com/newsroom/ (items undated)", "https://origence.com/blog/ (newest post 10/19/26)", "https://status.origence.com/ (page body not retrievable, metadata only)" ], "last_checked_utc": "2026-10-23T01:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page content could not be read (JavaScript-only rendering). Security and Compliance page lists program controls, including \"Vulnerability management\" (quoted from https://origence.com/security-and-compliance/), with no advisory or dated notice.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "oryx-dental", "company": "Oryx Dental", "canonical_domain": "oryxdental.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.oryxdental.com/", "https://www.oryxdental.com/security-privacy/", "https://www.oryxdental.com/news-education/" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. HIPAA Compliance and Security page has no PHP mention; Blog and News newest post October 21, 2026 (practice management software topic) with no PHP or security wording in its listing; no status page link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ovhcloud", "company": "OVHcloud", "canonical_domain": "ovhcloud.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://web-cloud.status-ovhcloud.com/incidents/6ct3ggp512xk", "statement_date": "Oct 22, 2026 - 14:12 UTC (latest; patch update Oct 21, 2026 - 17:53 UTC)", "status": "patched partly", "fixed_version_named": "yes: PHP 7.4 to 8.5 (branches only, no point releases)", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://web-cloud.status-ovhcloud.com/incidents/6ct3ggp512xk", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "All php release from 7.4 to 8.5 have been patch on all clusters.", "notes": "\"All php release from 7.4 to 8.5 have been patch on all clusters.\" and \"We are actually working on the previous release.\" (Oct 21, 2026 - 17:53 UTC) quoted from https://web-cloud.status-ovhcloud.com/incidents/6ct3ggp512xk (title: [GLOBAL][Web Hosting] - All clusters maintenance notification; OVHcloud's status site). Web Hosting clusters only (GRA and BHS); VPS and dedicated not mentioned. WAF rules modified on all clusters (14:50 UTC); \"Service reload will slowdown customers services.\"; maintenance window extended to 26/10/2026 18:00 UTC (Oct 22 update). Older releases (below 7.4) still in progress.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is OVHcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—OVHcloud’s Web Hosting service was affected, and OVHcloud confirms it has patched PHP 7.4–8.5 across all its hosting clusters. Older PHP versions are not yet confirmed patched. This is the status as of October 23, 2026. OVHcloud’s official status notice explicitly names CVE-2026-109618 and CVE-2026-109619 and gives this timeline: October 21, 08:00 UTC: Initial workaround implemented; OVHcloud subsequently reported", "cited_urls": [ "https://web-cloud.status-ovhcloud.com/incidents/6ct3ggp512xk" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is OVHcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of OVHcloud's exposure to and response regarding PHP2Shell (CVE-2026-109618 & CVE-2026-109619): What is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are both rated CVSS v4.0 9.2. Both CVEs are use-after-free bugs: CVE-2026-109618 involves an upload-progress unserializer use-after-free leading to remote memory disclosure and RCE, while CVE-2026-109619 involves a fatal-error backtrace use-after-free and OPcache", "cited_urls": [ "https://sansec.io/research/php2shell", "https://blog.ovhcloud.com/en/posts/critical-php-vulnerabilities-bare-metal-vps/", "https://mallory.ai/blog/php-rce-rapid-response", "https://meowapps.com/php2shell-wordpress/", "https://www.activeset.co/blog/php2shell-host-status" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is OVHcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—OVHcloud is affected where customers run PHP on Bare Metal servers or VPS instances, because PHP versions before the fixed releases are vulnerable. OVHcloud says WebCloud/shared-hosting customers are automatically covered by an updated PHP component. OVHcloud’s remediation status is: Web Hosting: OVHcloud deployed fixes across its Web Hosting clusters; the provider’s status indicates PHP 7.4–8.5 are patched. This status", "cited_urls": [ "https://php2shellcheck.com/hosting-status/", "https://community.ovhcloud.com/t/faille-critique-php-cve-2026-109618-109619-correctifs-sur-les-hebergements-web-ovhcloud/54166", "https://flawfence.com/blog/en/php2shell-cve-2026-109618-cve-2026-109619-php-rce-vulnerability/", "https://blog.ovhcloud.com/en/posts/critical-php-vulnerabilities-bare-metal-vps/", "https://mallory.ai/stories/01a15af8-3940-7c21-ac01-1dad5de4bd91", "https://github.com/hkoeck/php2shell-status", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://github.com/NCSC-NL/php2shell", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:18:09.009Z", "question": "Is OVHcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, OVHcloud infrastructure running PHP versions 7.4 through 8.5 was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and OVHcloud has implemented emergency workarounds and deployed patches. Summary of OVHcloud Status and Actions Impact: Affected systems include PHP sites running on OVHcloud Web Hosting clusters, Public Cloud instances, and Bare Metal servers (such as Kimsufi, So you Start, Rise,", "cited_urls": [ "https://web-cloud.status-ovhcloud.com/", "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/", "https://public-cloud.status-ovhcloud.com/", "https://blog.ovhcloud.com/en/posts/critical-php-vulnerabilities-bare-metal-vps/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is OVHcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected status: Yes, infrastructure running PHP (such as Bare Metal and VPS hosted environments) managed or provided by OVHcloud is inherently exposed to the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) if running unpatched PHP versions. Patch status: Official upstream patches for PHP were released by the PHP group on October 21, 2026. For OVHcloud customers using Bare", "cited_urls": [ "https://blog.ovhcloud.com/en/posts/critical-php-vulnerabilities-bare-metal-vps/", "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null } ] }, { "slug": "owncloud", "company": "ownCloud", "canonical_domain": "owncloud.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://central.owncloud.org/t/critical-update-for-owncloud-classic-available-php-vulnerabilities/95106", "statement_date": "October 22, 2026, 10:18am", "status": "patched", "fixed_version_named": "yes: ownCloud Classic 11.0.1 and 10.16.6 (owncloud/server:11.0.1 and owncloud/server:10.16.6 Docker images with patched PHP runtime); Calendar app v2.1.1 and v2.0.1", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://central.owncloud.org/latest", "https://central.owncloud.org/t/critical-update-for-owncloud-classic-available-php-vulnerabilities/95106", "https://owncloud.com/news/ (newest post 20 Oct 2026, nothing on PHP2Shell)", "https://owncloud.com/security-advisories/ (404)", "https://owncloud.com/security/ (policy page, no PHP2Shell content)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (ownCloud Server 10 and Classic 11 listed Vulnerable citing system requirements only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"Critical Update for OwnCloud Classic available - PHP vulnerabilities\" on ownCloud's own forum central.owncloud.org by user jordana, written in company voice (\"We are aware of the recently disclosed PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 known as PHP2Shell.\"); staff label not printed on the page. Mixed: \"Please update your ownCloud Classic installations immediately to the latest versions.\" and \"Customers not running docker version of OwnCloud Classic should update the PHP themselves\" quoted from the statement URL. ownCloud Infinite Scale (oCIS) stated unaffected. No PHP versions named.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "palo-alto-networks-pan-os-and-panorama", "company": "Palo Alto Networks, PAN-OS and Panorama", "canonical_domain": "paloaltonetworks.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://security.paloaltonetworks.com/CVE-2026-109618", "statement_date": "2026-10-21 (published and updated)", "status": "mitigation only", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://security.paloaltonetworks.com/CVE-2026-109618", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (PAN-OS and Panorama listed Vulnerable citing this advisory)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Advisory \"Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products\": PAN-OS 12.2, 12.1, 11.2, 11.1, 10.2 (all builds) and all Panorama versions affected; fixes \"in the upcoming releases\", ETA TBD. Not affected: Prisma Access, Cloud NGFW, Cortex XDR Agent, XSIAM, XSOAR, Xpanse, GlobalProtect App, Prisma Cloud and others. \"This issue strictly affects the management web interface, which includes the HTTPS web UI and XML API service.\" quoted from https://security.paloaltonetworks.com/CVE-2026-109618. Mitigations: Threat Prevention IDs 543004, 97622 to 97625, restrict management access to trusted IPs. Not aware of malicious exploitation.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Palo Alto Networks affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—some Palo Alto Networks products are affected, but patching is only partial. Its official advisory, updated October 23, 2026, covers both CVE-2026-109618 and CVE-2026-109619. | Product | Affected / patch status | |---|---| | PAN-OS 10.2, 11.1, 11.2, 12.1, 12.2 | All versions in these branches affected. No fixed releases listed; ETA TBD. | | Panorama | All versions", "cited_urls": [ "https://security.paloaltonetworks.com/CVE-2026-109618" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Palo Alto Networks affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on the latest search results (as of October 23, 2026), here is a detailed answer: Palo Alto Networks & PHP2Shell (CVE-2026-109618 & CVE-2026-109619) ✅ Is Palo Alto Networks Affected? Yes. Palo Alto Networks lists all PAN-OS and Panorama versions as affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). 🔴 Has It Been Patched? No — not yet. Palo Alto said", "cited_urls": [ "https://www.greenbone.net/en/blog/php2shell-remote-code-execution-cve-2026-109618-cve-2026-109619/", "https://www.allblogthings.com/2026/10/php2shell-leaves-palo-alto-firewalls-exposed-as-governments-go-dark.html", "https://mallory.ai/blog/php-rce-rapid-response", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Palo Alto Networks affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—but only some Palo Alto Networks products are affected. Palo Alto Networks lists all versions of PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 as affected, as well as Panorama. The advisory says the issue will be fixed in upcoming releases, but fixed versions and release dates were still listed as TBD in the latest update. Several other products are", "cited_urls": [ "https://www.paloaltonetworks.com/blog/cloud-security/how-cortex-cloud-protects-against-php2shell-vulnerabilities-from-code-to-cloud/", "https://security.paloaltonetworks.com/CVE-2026-109618", "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/?pdf=print&lg=en&_wpnonce=629ba058fb", "https://github.com/hkoeck/php2shell-status", "https://blog.boll.ch/php2shell-vulnerability-cve-2026-109618-and-cve-2026-109619/", "https://github.com/worldart/NCSC-NL_php2shell/blob/main/software/software_list_p.md", "https://www.triskelelabs.com/resources/php-critical-rce-cve-2026-109618-cve-2026-109619", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_p.md", "https://www.techtarget.com/cybersecurity/news/366652444/PHP2Shell-22M-exposed-servers-at-risk-as-emergency-patches-released", "https://www.nts.eu/en/security-update/security-advisories-october-2026-6/" ], "names_status": true, "status_named": "mitigation only", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is Palo Alto Networks affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Palo Alto Networks is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and permanent software fixes have yet been shipped. Affected Products & Status PAN-OS and Panorama: Palo Alto Networks confirmed that all versions of PAN-OS and appliance platforms are affected, with exposure restricted to the web management interface rather than core traffic routing. GlobalProtect: The GlobalProtect portal", "cited_urls": [ "https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/", "https://www.engineering.com/php2shell-for-manufacturers-the-danger-goes-deeper-than-a-website/", "https://live.paloaltonetworks.com/t5/next-generation-firewall/cve-2026-109618-and-cve-2026-109619-in-php-panos-affected/td-p/1266644", "https://security.paloaltonetworks.com/CVE-2026-109618", "https://www.paloaltonetworks.com/blog/network-security/critical-php-vulnerabilities-frontier-virtual-patching-customers-were-protected-before-day-one/", "https://www.reddit.com/r/paloaltonetworks/comments/1xbo5p9/update_on_php_cve2026109618_cve2026109619/", "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Palo Alto Networks affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Palo Alto Networks is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), specifically impacting the PAN-OS and Panorama management web interface (HTTPS web UI and XML API service). However, Palo Alto Networks has not yet released a direct PAN-OS software patch as of October 22, 2026, though fixed versions are planned for upcoming releases. What is Affected vs.", "cited_urls": [ "https://security.paloaltonetworks.com/CVE-2026-109618", "https://live.paloaltonetworks.com/t5/next-generation-firewall/cve-2026-109618-and-cve-2026-109619-in-php-panos-affected/td-p/1266644", "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "pantheon", "company": "Pantheon", "canonical_domain": "pantheon.io", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://status.pantheon.io/incidents/x7h8z1yhgvml", "statement_date": "Oct 21, 2026 - 19:08 PDT (Monitoring; first Oct 21, 2026 - 07:03 PDT)", "status": "patched partly", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; LTS builds for 8.1.x, 8.0.x, 7.4.x, 7.3.x, 7.2.x, 7.1.x, 7.0.x, 5.6.x", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://status.pantheon.io/incidents/x7h8z1yhgvml", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Patched PHP builds have been deployed to all LTS environments, all environments in SFTP mode, and all live environments running PHP 8.2 or later.", "notes": "\"Patched PHP builds have been deployed to all LTS environments, all environments in SFTP mode, and all live environments running PHP 8.2 or later.\" and \"all pre-production customer environments are patched. Free/sandbox environments will be updated over the next 24-48 hours.\" quoted from https://status.pantheon.io/incidents/x7h8z1yhgvml (title: PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619). Network mitigations remain in place; no customer action required; customers on End of Sale PHP versions advised to move to a supported version.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Pantheon affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Pantheon treated its hosted PHP environments as affected and has deployed patches. As of October 23, 2026, its official incident is marked Resolved, with the final update posted October 22 at 9:36 a.m. PDT. Pantheon’s patching timeline: October 21, 12:49 p.m. PDT: All live production sites running PHP 8.2–8.5 patched. October 21, 5:16 p.m. PDT: Production patching completed for", "cited_urls": [ "https://status.pantheon.io/incidents/x7h8z1yhgvml" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Pantheon affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of what is known about Pantheon's exposure to and response to PHP2Shell (CVE-2026-109618 & CVE-2026-109619): What Is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell, are two Remote Code Execution vulnerabilities in PHP. Both are rated CVSS v4.0 9.2. The bugs allow unauthenticated remote code execution and Heartbleed-style memory disclosure in PHP itself, independent", "cited_urls": [ "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://pantheon.io/blog/pantheon-response-during-critical-php-vulnerabilities", "https://www.activeset.co/blog/php2shell-host-status" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Pantheon affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Pantheon was affected because its managed PHP runtimes used vulnerable PHP branches, but it has patched the relevant production environments. Pantheon patched live production sites running supported PHP 8.2–8.5 with PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, the fixed upstream releases. Pantheon also completed patching LTS environments and SFTP-mode environments, and reported that most paid non-live environments were patched.", "cited_urls": [ "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_p.md", "https://github.com/worldart/NCSC-NL_php2shell/blob/main/software/software_list_p.md", "https://meowapps.com/php2shell-wordpress/", "https://onlineornot.com/status/pantheon/incidents/depa7G1YoXWK", "https://mallory.ai/blog/php-rce-rapid-response", "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://en.wikipedia.org/wiki/PHP2Shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Pantheon affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Pantheon environments running vulnerable PHP versions were affected by the PHP2Shell vulnerabilities ( and CVE-2026-109619), and the platform has actively rolled out patches and runtime/network mitigations. Rollout Status & Patch Details Affected Sites: Platforms running PHP versions prior to the emergency releases (PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12) or legacy/LTS branches were exposed to the critical remote code", "cited_urls": [ "https://status.pantheon.io/", "https://pantheon.io/blog/pantheon-response-during-critical-php-vulnerabilities", "https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Pantheon affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Pantheon was affected by the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which are core PHP remote code execution flaws. Yes, Pantheon has patched it. Live and Pre-production Environments: Pantheon rolled out updated PHP container images across all live and pre-production customer environments (including supported LTS versions), completing the rollout by October 21, 2026. Free/Sandbox Environments: Scheduled for updates", "cited_urls": [ "https://pantheon.io/blog/pantheon-response-during-critical-php-vulnerabilities", "https://www.youtube.com/watch?v=JaAr-lEIbMk", "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/", "https://status.pantheon.io/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null } ] }, { "slug": "partner-xe-sis", "company": "Partner XE (SIS)", "canonical_domain": "sisware.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Partner XE SIS PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.sisware.com/ (302 redirect to https://www.zywave.com/products/partner-platform/)", "https://www.zywave.com/products/partner-platform/ (Zywave Partner Platform product page, no PHP mention", "does not name Partner XE or SIS)", "https://www.zywave.com/hipaa-security/ (Zywave HIPAA security incident reporting page, no PHP mention)", "https://www.zywave.com/newsroom/ (newest item Oct 20, 2026, Zywave Apex AI updates, no PHP mention in listing)", "https://www.zywave.com/blogs/ (posts undated, none on PHP)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "sisware.com redirects to Zywave's Partner Platform page; no SIS-specific security, status or news page located. See the Zywave row.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "passbolt", "company": "Passbolt", "canonical_domain": "passbolt.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2", "statement_date": "October 21st, 2026", "status": "patched", "fixed_version_named": "yes: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 (patched Docker image, Helm chart, AWS AMI, OVA and DigitalOcean images published 21 Oct 2026)", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Passbolt API server listed Fix citing this incident page)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Incident page \"Critical PHP vulnerabilities (CVSS 9.2)\" names CVE-2026-109618 and CVE-2026-109619. Mixed: Passbolt Cloud taken offline at 14:30 CEST as a precaution and restored at 17:25 CEST after patching, no trace of exploitation so far; Docker image, Helm chart, AMI, OVA fixed (DigitalOcean awaiting marketplace review); existing AMI/OVA instances and distribution-package installs must update PHP through the OS package manager. \"The Passbolt API runs on PHP, so every Passbolt server is concerned.\" and \"Self-hosted administrators must update PHP and restart their PHP services.\" quoted from the statement URL. Unsupported PHP versions noted as affected; fixes for distribution packages arrive through distribution security updates.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "paxerahealth", "company": "PaxeraHealth", "canonical_domain": "paxerahealth.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:PaxeraHealth PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.paxerahealth.com/", "https://trust.paxerahealth.com/ (Trust Center)", "https://paxerahealth.com/corporate-news/ (newest Aug 10, 2026)", "https://paxerahealth.com/blog/ (posts undated)" ], "last_checked_utc": "2026-10-23T01:40:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trust Center lists gated compliance documents and a \"Security document Version 4.5\" with no date; no advisory. No status page located.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "pbs-systems", "company": "PBS Systems", "canonical_domain": "pbssystems.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:PBS Systems dealership PHP2Shell", "https://www.pbssystems.com/", "https://www.pbssystems.com/blog", "https://www.pbssystems.com/official-company-information" ], "last_checked_utc": "2026-10-23T00:37:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status link in site navigation; news/blog newest post Oct 6 (Dealer Conference 2026 recap), no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "pcs-software", "company": "PCS Software", "canonical_domain": "pcssoft.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.pcssoft.com/", "https://pcssoft.com/about-us/news-and-events/", "https://pcssoft.com/blog/" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or status page on pcssoft.com (customer portal is a login). Newest dated news item 28 April 2026; blog posts undated. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "penta-software", "company": "Penta Software", "canonical_domain": "penta.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Penta Technologies construction PHP2Shell", "https://www.penta.com/", "https://penta.com/blog/" ], "last_checked_utc": "2026-10-23T00:29:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust, status or news link in site navigation; blog newest post July 23, 2026. Search result \"Penta Security Deploys WAF Rules for PHP2Shell\" (pentasecurity.com) is a different company, not Penta Technologies.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "pfsense-netgate", "company": "pfSense, Netgate", "canonical_domain": "pfsense.org", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://www.netgate.com/blog/critical-php-security-update", "statement_date": "October 21, 2026", "status": "patched", "fixed_version_named": "yes: PHP 8.5.12 for pfSense Plus 26.07, 26.03.1 and CE 2.9.0; PHP 8.3.36 for CE 2.8.1", "workers_restart_stated": "yes", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://www.netgate.com/blog/critical-php-security-update", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (pfSense management components listed Fix citing this post and release notes)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"Critical PHP Security Update\" names CVE-2026-109618 and CVE-2026-109619 and ships updated PHP packages for pfSense Plus 26.07 and 26.03.1 and pfSense CE 2.9.0 (PHP 8.5.12) and CE 2.8.1 (PHP 8.3.36). Customer must apply them from the command line: \"These binary package updates cannot be performed using the pfSense software PHP GUI or the Nexus GUI.\" and \"Anyone who has exposed their GUI to the Internet or other untrusted networks should update PHP immediately.\" quoted from the statement URL. Three methods: full package update then reboot, or update then restart PHP GUI, web GUI and Captive Portal, or restart PHP GUI only; WireGuard package reinstalled last. Users of older releases urged to move to a current supported release; GUI reachable only from LAN by default and Captive Portal inactive by default.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is pfSense affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—pfSense is affected, and Netgate has released patches. As of October 23, 2026, Netgate’s official advisory confirms both CVE-2026-109618 and CVE-2026-109619 affect pfSense installations. The advisory was published October 21, 2026. Exposure The relevant attack surfaces are the PHP management GUI and Captive Portal when reachable by potential attackers. The GUI is LAN-only by default; Captive Portal is disabled", "cited_urls": [ "https://www.netgate.com/blog/critical-php-security-update" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is pfSense affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, pfSense is affected by PHP2Shell, and patches have been released. Here is a full breakdown with sources: PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — Impact on pfSense What is PHP2Shell? The PHP project released fixes on October 21, 2026, for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both carry a CVSS v4.0 score of 9.2 (Critical Severity).", "cited_urls": [ "https://www.security.com/blog-post/php2shell-critical-vulns-cve-2026-109618-109619", "https://www.netgate.com/blog/critical-php-security-update", "https://forum.netgate.com/topic/201565/critical-php-security-update", "https://mallory.ai/blog/php-rce-rapid-response" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is pfSense affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. pfSense is affected because its web-management components use PHP, and Netgate has released fixed PHP packages for supported pfSense versions. Patched versions listed by the NCSC-NL PHP2Shell tracker are: pfSense Plus 26.07 and 26.03.1: PHP 8.5.12 pfSense CE 2.9.0: PHP 8.5.12 pfSense CE 2.8.1: PHP 8.3.36 The fix addresses CVE-2026-109618 and CVE-2026-109619. Existing installations reportedly require a command-line", "cited_urls": [ "https://note.com/pc_article/n/n9a45909e7a32?hl=en", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_n.md", "https://mallory.ai/blog/php-rce-rapid-response", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://isc.sans.edu/diary/rss/33440", "https://github.com/NCSC-NL/php2shell", "https://isc.sans.edu/diary/0", "https://en.wikipedia.org/wiki/PHP2Shell", "https://sansec.io/research/php2shell", "https://github.com/0xDTC/0xPHP2SHELL-Impact-Analysis/blob/master/Readme.md" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:33.102Z", "question": "Is pfSense affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, pfSense is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because it uses PHP for its webConfigurator GUI and backend scripts, though exposure depends heavily on network access. Netgate published an official security advisory stating that users can update their systems through System > Update > Update Settings to apply the latest package and PHP fixes. Key Details", "cited_urls": [ "https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619", "https://www.netgate.com/blog/critical-php-security-update", "https://forum.netgate.com/post/1250397" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is pfSense affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "You’ve reached the request limit for AI responses right now. Try again in a little while.", "cited_urls": [], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "philips-healthsuite-imaging", "company": "Philips (HealthSuite Imaging)", "canonical_domain": "philips.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Philips HealthSuite Imaging PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.philips.com/healthcare (302 redirect to https://www.usa.philips.com/healthcare, read)", "https://www.philips.com/productsecurity", "https://www.philips.com/a-w/security/security-advisories.html (newest advisory 2026 Oct 19)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Philips Security Advisories page lists third-party advisories through 19 October 2026 (BeyondTrust, Ivanti, Mirth Connect); none mentions PHP, PHP2Shell or the CVEs. No status page located.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "phpmyadmin", "company": "phpMyAdmin", "canonical_domain": "phpmyadmin.net", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.phpmyadmin.net/ (news newest 8 Oct 2025", "developer blog newest 7 Oct 2026, nothing on PHP2Shell)", "https://www.phpmyadmin.net/news/", "https://www.phpmyadmin.net/security/ (newest PMASA-2025-3)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (phpMyAdmin listed Vulnerable citing requirements only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No phpMyAdmin statement on PHP2Shell found on the home page, news or PMASA security list as of the last check. NCSC-NL inventory lists phpMyAdmin as Vulnerable on the basis of PHP requirements, not a project statement. Synology's 22 Oct 2026 statement lists its phpMyAdmin package among affected PHP-dependent packages.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "pipedrive", "company": "Pipedrive", "canonical_domain": "pipedrive.com", "group": "index_vendor", "index_category": "crm", "statement_found": true, "statement_url": "https://status.pipedrive.com/", "statement_date": "21 Oct 2026 14:59:36 UTC (first update), 19:11:47 UTC (resolved)", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "status page", "places_checked": [ "search:Pipedrive PHP2Shell", "https://www.pipedrive.com/en/trust-center (302 redirect to https://trustcenter.pipedrive.com/)", "https://trustcenter.pipedrive.com/ (trust center, no PHP item, dated updates are sub-processor and policy changes)", "https://status.pipedrive.com/ (statement, incident on the status page, no separate permalink shown)" ], "last_checked_utc": "2026-10-23T02:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Incident \"[Resolved] Recent PHP Security Vulnerabilities: No Action Required\": \"We have updated PHP to the latest version, which addresses the recently disclosed security vulnerabilities.\" and \"The update is complete and our systems are no longer affected.\" (21 Oct 2026, 19:11:47 UTC) and earlier \"No action is required from customers at this time.\" (14:59:36 UTC) quoted from https://status.pipedrive.com/. No version number, restart or EOL branch named.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "planet-dds-denticon", "company": "Planet DDS (Denticon)", "canonical_domain": "planetdds.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.planetdds.com/", "https://www.planetdds.com/newsroom/", "https://www.planetdds.com/blog/", "https://securityscorecard.com/security-rating/trust-center/planetdds.com (redirected to scores.securityscorecard.io, not fetched)" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Newsroom newest item October 7, 2026; blog newest posts October 2026; trust center is hosted on SecurityScorecard, not on planetdds.com; no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "planet-protel", "company": "Planet protel", "canonical_domain": "protel.net", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Planet protel PHP2Shell", "https://www.protel.net/ (302 redirect to https://www.weareplanet.com/welcome-protel)", "https://www.weareplanet.com/welcome-protel (landing page, no status link)", "https://www.weareplanet.com/legal/vulnerability-disclosure-program (disclosure program page, no PHP mention)", "https://www.weareplanet.com/news (newest item October 20, 2026, Shopify POS Tax Free partnership, no PHP mention)", "https://www.weareplanet.com/news/planet-tax-free-shopping-shopify-pos-global-retailers (news item dated October 20, 2026, no PHP or security patch mention)", "https://www.weareplanet.com/blog (newest post October 19, 2026)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "protel.net redirects to Planet (weareplanet.com). Newest newsroom item (October 20, 2026) is a partnership announcement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "platform-sh", "company": "Platform.sh", "canonical_domain": "platform.sh", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://upsun.com/blog/php2shell-upsun-response/", "statement_date": "22 October 2026", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://status.platform.sh/ (redirects to https://status.upsun.com/, which did not render)", "https://platform.sh/blog/ (redirects to https://upsun.com/blog/)", "https://upsun.com/blog/", "https://upsun.com/blog/php2shell-upsun-response/", "search:Platform.sh PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:28:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Platform.sh now operates as Upsun (platform.sh pages redirect to upsun.com; Upsun press release of September 23, 2025 says Platform.sh evolved into Upsun). \"At 23:35, the status page confirmed every Upsun Cloud region was updated.\" (21 October; last patches in place at 04:12 on 22 October) and \"we patched and restarted affected sites for them.\" quoted from https://upsun.com/blog/php2shell-upsun-response/ (title: How Upsun handled PHP2Shell: protection in place 22 hours before the patch). Edge WAF rules were blocking attacks in every region from 15:50 on 20 October; customers did not need to act; older unsupported PHP versions were patched the same evening and versions too old to fix are handled by contacting affected customers. No fixed version numbers named. Earlier post: https://upsun.com/blog/php-critical-security-release-oct2026/ (October 21, 2026, not read).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "plesk", "company": "Plesk", "canonical_domain": "plesk.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk", "statement_date": "Updated October 22, 2026 00:00 (changelog entries dated 21 October 2026)", "status": "patched partly", "fixed_version_named": "yes: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 (Linux and Windows); EOL PHP 7.4.33, 8.0.30, 8.1.34 rebuilt with a 21 October 2026 build date (Linux); sw-engine fixed in Plesk Obsidian 18.0.81 Update 4", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.plesk.com/blog/ (no PHP post)", "https://docs.plesk.com/release-notes/obsidian/change-log/", "https://support.plesk.com/hc/en-us", "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk", "search:Plesk PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:08:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Fixes for EOL PHP versions 7.4.33, 8.0.30, 8.1.34 have the same version number, but different build date.", "notes": "\"Fixes for EOL PHP versions 7.4.33, 8.0.30, 8.1.34 have the same version number, but different build date.\" \"Versions built on 21 October 2026 have fixes included.\" and \"The fix for sw-engine in Plesk Obsidian 18.0.80 is still pending.\" (planned as 18.0.80 Update 11) quoted from the Plesk KB article (title: Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk). Plesk says it has rebuilt the PHP builds and delivers them to Plesk servers; administrators told to check PHP versions and build dates; PHP 5.6, 7.2, 7.3 pointed to TuxCare ELS. Changelog https://docs.plesk.com/release-notes/obsidian/change-log/ (21 October 2026): \"Updated PHP 8.5 to version 8.5.12. Updated PHP 8.4 to version 8.4.27.\" (also 8.3.36, 8.2.35) and 18.0.81 Update 4 / 18.0.80 Update 11: \"Updated plesk-engine and sw-engine PHP to version 8.4.27.\" No restart statement in the article.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Plesk affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Plesk is affected, and patches are available as of October 23, 2026. Plesk confirms that both CVEs affect the PHP versions it ships, including the PHP engine used by the control panel itself, on Linux and Windows. Its current advisory was updated October 22, 2026. What has been patched? | Component | Fixed versions | |---|---| | Hosted-site PHP", "cited_urls": [ "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk", "https://docs.plesk.com/release-notes/obsidian/change-log/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Plesk affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Plesk is confirmed to be affected by PHP2Shell, and patches have been issued. Here is a detailed breakdown: Is Plesk Affected by PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? Yes. Two security vulnerabilities were discovered in PHP, and as a result, all PHP versions shipped with Plesk are also affected. CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. The PHP security", "cited_urls": [ "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-PHP2Shell-Remote-code-execution-in-PHP-shipped-with-Plesk", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://itproexpert.com/critical-php2shell-vulnerability-alert-majority-online-servers-and-services-affected-cve-2026-109618-109619/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Plesk affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Plesk was affected: Plesk states that all PHP versions shipped with Plesk for Linux and Windows were vulnerable to CVE-2026-109618 and CVE-2026-109619, which allow critical remote code execution. Patches are now available for most supported versions: PHP 8.5: 8.5.12 PHP 8.4: 8.4.27 PHP 8.3: 8.3.36 PHP 8.2: 8.2.35 PHP 8.1: 8.1.34 built on or after October 21, 2026", "cited_urls": [ "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-PHP2Shell-Remote-code-execution-in-PHP-shipped-with-Plesk", "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk", "https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html", "https://www.panellicense.com/kb/php2shell-cve-2026-109618-109619-hosting-servers/", "https://www.digitalapplied.com/blog/php2shell-fixes-by-distro-control-panel-php-version", "https://github.com/hkoeck/php2shell-status", "https://talk.plesk.com/threads/eta-for-critical-php-security-updates-cve-2026-109618-cve-2026-109619.395516/", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_p.md", "https://talk.plesk.com/threads/eta-for-critical-php-security-updates-cve-2026-109618-cve-2026-109619.395516/page-7", "https://www.unlimitedwebhosting.co.uk/blog/php2shell-critical-php-vulnerabilities/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is Plesk affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, all PHP versions shipped with Plesk are affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and Plesk has been rolling out fixes and backported builds through its repositories. Status and Patch Details Impact: All PHP versions shipped or installed with Plesk are affected because the flaws exist in the core PHP runtime. Fixes Released: Official PHP fixes were", "cited_urls": [ "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk", "https://belitsoft.com/hire-php-developers/CVE-2026-109618-CVE-2026-109619", "https://talk.plesk.com/threads/eta-for-critical-php-security-updates-cve-2026-109618-cve-2026-109619.395516/page-5", "https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Plesk affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Plesk is affected by the PHP2Shell critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and Plesk has released patches for both the Plesk engine (sw-engine) and the PHP packages it ships. Patch and Impact Summary Plesk Core Engine (sw-engine / plesk-engine): Fixed in Plesk Obsidian 18.0.81 Update 4 and Plesk Obsidian 18.0.80 Update 11 (available for both Plesk for Linux and", "cited_urls": [ "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "ploi", "company": "Ploi", "canonical_domain": "ploi.io", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://status.ploi.io/status-page/ploi/history", "statement_date": "21:32 CEST, Oct 21, 2026", "status": "customer must update", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://ploi.io/ (no banner)", "https://ploi.io/blog (fetch failed, client_error)", "https://ploi.io/news (newest item 20 Oct 2026, not PHP)", "https://status.ploi.io/", "https://status.ploi.io/status-page/ploi/history", "search:Ploi PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:32:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "PHP released the fixes today in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.", "notes": "\"PHP released the fixes today in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.\" \"Press Patch in the PHP tab of your server\" (or Manage → Updates → Run now) \"PHP 8.1 and older get no official release.\" \"Upgrade those applications to PHP 8.4 or 8.5.\" quoted from https://status.ploi.io/status-page/ploi/history (notice: Critical PHP vulnerabilities, 21:32 CEST, Oct 21; no permalink). Ploi is a server management panel: customers patch their own servers; builds were lagging (\"The package builders are still catching up with demand.\") with packages.sury.org suggested; a marketplace script turning off session.upload_progress.enabled is offered as \"a partial mitigation, not a fix\".", "ai_answer_note": null, "ai_answers": [] }, { "slug": "postdicom", "company": "PostDICOM", "canonical_domain": "postdicom.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:PostDICOM PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.postdicom.com/", "https://www.postdicom.com/en/trust (Trust Center)", "https://www.postdicom.com/en/blog/contents (posts undated)" ], "last_checked_utc": "2026-10-23T01:40:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trust Center describes architecture and certifications; no advisory or dated notice. No status, news or press page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "practice-web", "company": "Practice-Web", "canonical_domain": "practice-web.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.practice-web.com/", "https://www.practice-web.com/practice-management/security-and-system-reqs", "https://www.practice-web.com/responsible-disclosure", "https://www.practice-web.com/resources/thrive-blog (listing did not render)", "https://blog.practice-web.com/ (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T01:19:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Security and System Requirements page and Responsible Disclosure page have no PHP mention; blog could not be read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "practicepanther", "company": "PracticePanther", "canonical_domain": "practicepanther.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:PracticePanther PHP2Shell", "https://www.practicepanther.com/security/ (security page, metadata modified 2026-07-27, no PHP or CVE mention, links status page practicepanther.statuspage.io)", "https://status.practicepanther.com/ (status page)", "https://www.practicepanther.com/blog/ (blog, posts undated, none on PHP)" ], "last_checked_utc": "2026-10-23T02:03:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for Oct 20 and Oct 21, 2026 and \"No incidents reported today.\" for Oct 22, 2026, quoted from https://status.practicepanther.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "pressable", "company": "Pressable", "canonical_domain": "pressable.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://pressablestatus.com/2026/10/21/php-cvss-v4-0-9-2-patch/", "statement_date": "October 21, 2026 (7:00 am; published_time 2026-10-21T12:00:00+00:00)", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "status page", "places_checked": [ "https://pressablestatus.com/2026/10/21/php-cvss-v4-0-9-2-patch/", "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Pressable sites are already protected against both vulnerabilities.", "notes": "\"Pressable sites are already protected against both vulnerabilities.\" \"Every PHP version available on Pressable is protected.\" \"Pressable customers do not need to take action.\" quoted from https://pressablestatus.com/2026/10/21/php-cvss-v4-0-9-2-patch/ (title: Pressable-Powered Sites Protected Against Critical PHP Vulnerabilities; pressablestatus.com is Pressable's status site). Names no fixed build. Also covered by parent Automattic post of October 21, 2026.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "prestashop", "company": "PrestaShop", "canonical_domain": "prestashop.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://build.prestashop-project.org/news/2026/php-security-updates-october-2026/", "statement_date": "Oct 21, 2026", "status": "customer must update", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.prestashop-project.org/news/ (404)", "https://www.prestashop-project.org/", "https://www.prestashop.com/en/blog (fetch limit at first try)", "https://build.prestashop-project.org/news/", "https://build.prestashop-project.org/news/2026/php-security-updates-october-2026/", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (PrestaShop listed Vulnerable citing version 9 requirements only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"Critical PHP security updates: what PrestaShop users need to know\" by Krystian Podemski (VP of Technology & Community, PrestaShop) on the project's build blog names CVE-2026-109618 and CVE-2026-109619 (php2shell, CVSS 9.2). \"Updating PrestaShop or your modules will not fix this.\" and \"An update that is installed but not loaded does not protect you.\" quoted from the statement URL. Merchants to confirm with their host, in writing, that the running PHP has the fix; self-managed servers install the PHP update and restart every PHP process (PHP-FPM pools, Apache, LiteSpeed, FrankenPHP workers). PHP 8.1 and older no longer get official updates (backports exist for 7.4, 8.0, 8.1); PHP 8.2 EOL 31 Dec 2026; PrestaShop 9 recommended. Docker users told to rebuild on the updated base image.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is PrestaShop affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—PrestaShop stores running unpatched PHP are affected, but the flaws are in PHP itself, not PrestaShop. PrestaShop’s official advisory covers CVE-2026-109618 and CVE-2026-109619 and says all PrestaShop versions, from 1.6 through 9, are concerned because they run on PHP. Has it been patched? PHP fixes were released on October 21, 2026. There is no PrestaShop-specific patch: updating PrestaShop or", "cited_urls": [ "https://help-center.prestashop.com/hc/en-us/articles/40026950278930-Critical-PHP-vulnerabilities-php2shell-what-PrestaShop-merchants-need-to-know" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is PrestaShop affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on the search results, I was unable to find any PrestaShop-specific advisory, patch, or statement regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Here is what is known about PHP2Shell and how it relates to PrestaShop: PHP2Shell (CVE-2026-109618 & CVE-2026-109619) and PrestaShop What is PHP2Shell? The PHP development team released emergency security updates to fix PHP2Shell — two critical vulnerabilities (CVE-2026-109618", "cited_urls": [ "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://www.guidepointsecurity.com/blog/how-to-patch-php2shell/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is PrestaShop affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—PrestaShop installations are potentially affected, but the vulnerability is in the PHP runtime, not in PrestaShop’s application code. Any PrestaShop store running an unpatched PHP version that serves web requests is at risk. Patch status: PHP released fixes on October 21, 2026: PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35 PHP 7.4–8.1 have source backports but no standard official", "cited_urls": [ "https://sansec.io/research/php2shell", "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619", "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://kuponaut.com/blog/php2shell-what-to-do-if-your-site-runs-php/", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:33.102Z", "question": "Is PrestaShop affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, PrestaShop sites are affected if they run on a vulnerable PHP runtime version, because PHP2Shell is a flaw in the PHP engine itself rather than a bug in PrestaShop's own application code. The PHP project released emergency patches on October 21, 2026, to fix both vulnerabilities. To protect your store, your server administrator or hosting provider must update", "cited_urls": [ "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://build.prestashop-project.org/news/2026/php-security-updates-october-2026/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is PrestaShop affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, PrestaShop is indirectly affected because it is a PHP-based application. The vulnerabilities CVE-2026-109618 and CVE-2026-109619 (jointly known as PHP2Shell) are severe, memory-handling flaws residing in the PHP core runtime engine, not within PrestaShop's own application code. Because the flaw exists in PHP itself, virtually every PrestaShop store is vulnerable if the underlying server environment runs an unpatched PHP", "cited_urls": [ "https://build.prestashop-project.org/news/2026/php-security-updates-october-2026/", "https://it.uw.edu/help/servicestatus/php-cves/", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "princeton-tmx", "company": "Princeton TMX", "canonical_domain": "princetontmx.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.princetontmx.com/", "https://www.princetontmx.com/health-status", "https://www.princetontmx.com/resources" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. App Health Status page lists no incidents; no security or trust page beyond homepage marketing text (SOC 1 Type 2, AWS WAF). News and blog items undated, none on security. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "pro-medicus", "company": "Pro Medicus", "canonical_domain": "promedicus.com.au", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Pro Medicus PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.promedicus.com.au/ (302 redirect to https://www.promed.com.au/, read)", "https://www.promed.com.au/about/compliance/", "https://www.promed.com.au/news/ (newest 18 August 2026)", "https://www.promed.com.au/support/" ], "last_checked_utc": "2026-10-23T01:40:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "promedicus.com.au redirects to promed.com.au. No security, trust or status page linked; newest news items are the FY26 results (18 August 2026). Visage Imaging (its subsidiary) is recorded in its own row.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "procore", "company": "Procore", "canonical_domain": "procore.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Procore PHP2Shell", "https://www.procore.com/security", "https://status.procore.com/", "https://www.procore.com/newsroom" ], "last_checked_utc": "2026-10-23T00:13:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Security page has no PHP mention; status page shows no incidents 20 to 22 Oct 2026; newsroom newest items 21 Oct 2026 are product and partnership announcements, none about PHP.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "prolaw", "company": "ProLaw", "canonical_domain": "prolaw.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:ProLaw PHP2Shell", "search:ProLaw CVE-2026-109618", "https://www.prolaw.com/ (fetch failed: robots_disallowed)", "https://www.elite.com/ (parent company homepage)", "https://trust.elite.com/ (Elite Trust Center)", "https://www.elite.com/insights/news" ], "last_checked_utc": "2026-10-23T00:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "prolaw.com refused automated fetch (robots_disallowed). ProLaw is a product of Elite (elite.com); the Elite Trust Center and Elite newsroom carry no PHP2Shell or CVE-2026-109618 item as of the check. Newest Elite news item on the homepage is dated October 20, 2026 and concerns Microsoft Copilot connectors, not PHP.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "property-matrix", "company": "Property Matrix", "canonical_domain": "propertymatrix.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Property Matrix PHP2Shell", "https://www.propertymatrix.com/ (homepage, no security, trust, status or newsroom link, no notice)", "https://www.propertymatrix.com/blog (newest post Jul 7, 2025, none on PHP)" ], "last_checked_utc": "2026-10-23T02:13:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from propertymatrix.com. No PHP2Shell item found.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "propertyware", "company": "Propertyware", "canonical_domain": "propertyware.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Propertyware PHP2Shell", "https://www.propertyware.com/ (homepage, a RealPage product, no security, trust, status or newsroom link, no notice)", "https://www.propertyware.com/blog/ (blog, posts undated, newest titles reference 2024, none on PHP)" ], "last_checked_utc": "2026-10-23T02:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from propertyware.com; the footer links RealPage's DMCA notice.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "provet", "company": "Provet", "canonical_domain": "provet.cloud", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.provet.cloud/ (redirects to https://www.provet.com/)", "https://www.provet.com/", "https://www.provet.com/product/data-security", "https://www.provet.com/release-log", "https://www.provet.com/blog" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. Data security page (ISO 27001) has no advisories; no status page found. Release log entry 20 October 2026 covers patient admission, pricing and shortcuts, no security content; newest blog post 2 October 2026. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "qnap", "company": "QNAP", "canonical_domain": "qnap.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://www.qnap.com/en/security-advisory/qsa-26-18", "statement_date": "October 22, 2026 (V1.0)", "status": "mitigation only", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://www.qnap.com/en/security-advisory/qsa-26-18", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (QNAP QTS, QuTS hero, QuTScloud, QuMagie, Note Station 3, QNE, QVR Surveillance listed Vulnerable citing QSA-26-18)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "QSA-26-18 \"Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products\", severity Critical, status Fixing, fixed versions \"To be announced\". Affected: QTS 6.1.0, QTS 5.2.11 and earlier, QuTS hero h6.1.0, h6.0.x, h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, QuMagie 2.10.1 and earlier, Note Station 3 3.9.14 and earlier, QNE (ADRA) 1.0.7 and earlier, QVR Surveillance 3.0.3 and earlier (ARM32), TVR OS 1.0.4 and earlier. \"Until fixed versions are available, the most effective protection is to keep the device off the internet.\" quoted from https://www.qnap.com/en/security-advisory/qsa-26-18. Mitigations: disable port forwarding, UPnP and myQNAPcloud Link, VPN only, restrict management ports, stop unneeded PHP apps, run Security Center and Malware Remover.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is QNAP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—QNAP confirms affected products, but no product patches are listed as released as of October 23, 2026. Its official advisory QSA-26-18, published October 22, covers both CVE-2026-109618 and CVE-2026-109619 and remains marked “Fixing,” with fixed versions “To be announced.” The affected-products list includes: QTS: 6.1.0; 5.2.11 and earlier QuTS hero: h6.1.0; h6.0.x; h5.2.11 and earlier QuTScloud: c5.2.9 and earlier", "cited_urls": [ "https://www.qnap.com/en/security-advisory/qsa-26-18" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is QNAP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, QNAP is confirmed to be affected by PHP2Shell, but patches have not yet been released as of today (October 23, 2026). Here is a detailed breakdown: ⚠️ QNAP & PHP2Shell (CVE-2026-109618 & CVE-2026-109619) What is PHP2Shell? PHP2Shell refers to two critical PHP vulnerabilities that can allow unauthenticated remote code execution. The PHP security team rates both CVSSv4.0 9.2", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance", "https://appleinsider.com/articles/26/10/22/critical-php-vulnerabilities-threaten-your-nas-not-every-vendor-has-a-fix", "https://note.com/zephel01/n/n7ae68484bb77?hl=en", "https://community.qnap.com/t/security-notice-qnap-statement-on-critical-php-vulnerabilities-php2shell-security-advisory-qsa-26-18/7293", "https://securityonline.info/qnap-php2shell-vulnerabilities-qts/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is QNAP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. QNAP is affected by both PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. QNAP’s advisory identifies affected products including QTS, QuTS hero, QuTScloud, TVR OS, and Note Station 3; for example, QTS 5.2.11 and earlier and Note Station 3.9.14 and earlier are listed as vulnerable. As of October 23, 2026, QNAP had not yet released patches for the affected products. QNAP", "cited_urls": [ "https://community.qnap.com/t/qnap-php-php2shell-qsa-26-18/7292", "https://community.qnap.com/t/security-notice-qnap-statement-on-critical-php-vulnerabilities-php2shell-security-advisory-qsa-26-18/7293", "https://community.qnap.com/t/security-notice-qnap-statement-on-critical-php-vulnerabilities-php2shell-security-advisory-qsa-26-18/7293?tl=de", "https://community.qnap.com/t/qnap-php-php2shell-qsa-26-18/7292?tl=de", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_q.md", "https://www.cert.ug/qnap-security-update", "https://note.com/pc_article/n/n9a45909e7a32?hl=en", "https://cert.ug/index.php/qnap-advisory", "https://appleinsider.com/articles/26/10/22/critical-php-vulnerabilities-threaten-your-nas-not-every-vendor-has-a-fix", "https://github.com/NCSC-NL/php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:18:09.009Z", "question": "Is QNAP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, QNAP is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Affected QNAP Products According to QNAP's security advisory, the vulnerabilities impact multiple software versions and packages: QTS: 6.1.0, 5.2.11 and earlier QuTS hero: h6.1.0, h6.0.x, h5.2.11 and earlier QuTScloud: c5.2.9 and earlier QuMagie: 2.10.1 and earlier Note Station 3: 3.9.14 and earlier QNE (ADRA): 1.0.7 and earlier QVR", "cited_urls": [ "https://www.qnap.com/en-us/security-advisory/qsa-26-18" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is QNAP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "QNAP is assessing its product lines for the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and has published an official statement detailing ongoing evaluations and mitigation guidance rather than a universal patch release status for all firmware packages. Overview of QNAP's Response Official Statement: QNAP released an advisory titled QNAP Statement on Critical PHP Vulnerabilities (PHP2Shell): Assessment and Mitigation Guidance. Current", "cited_urls": [ "https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://github.com/NCSC-NL/php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "quikfuzion", "company": "Quikfuzion", "canonical_domain": "quikfuzion.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Quikfuzion PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.quikfuzion.com/ (homepage", "no security, status, blog or news link", "only product, company, careers and legal pages linked)", "https://www.quikfuzion.com/company (company page, no PHP or security notice, no security, status or news link", "rechecked 2026-10-23T02:20Z)", "https://www.quikfuzion.com/security (fetch failed, client error, 2026-10-23T02:20Z)", "https://status.quikfuzion.com/ (fetch failed, robots disallowed, 2026-10-23T02:20Z)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Site publishes no blog, newsroom, security or status page from its navigation.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "quorum-information-technologies", "company": "Quorum Information Technologies", "canonical_domain": "quorumdms.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Quorum DMS PHP2Shell", "https://www.quorumdms.com/ (fetch failed, robots disallowed)", "https://www.quorumdms.com/news (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:37:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Company site disallows automated page reads; search returned no Quorum PHP2Shell item.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "raken", "company": "Raken", "canonical_domain": "rakenapp.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Raken PHP2Shell", "https://www.rakenapp.com/security", "https://www.rakenapp.com/blog" ], "last_checked_utc": "2026-10-23T00:28:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "System Security page has no PHP mention; blog listing shows no dates and no security post; no status page link found.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ramsoft", "company": "RamSoft", "canonical_domain": "ramsoft.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:RamSoft PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.ramsoft.com/", "https://www.ramsoft.com/compliance", "https://www.ramsoft.com/media-room (newest March 9, 2026)", "https://www.ramsoft.com/blogs (newest Sep 02, 2026)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security advisory, trust center or status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "razorsync", "company": "RazorSync", "canonical_domain": "razorsync.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:RazorSync PHP2Shell", "https://www.razorsync.com/ (homepage", "footer has no security, trust or status link)", "https://www.razorsync.com/resources/ (blog, newest post 1 Oct 2025)", "https://www.razorsync.com/security/ (fetch failed, client error)", "https://status.razorsync.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from the homepage; the blog's newest post is dated 1 Oct 2025.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "redteam", "company": "RedTeam", "canonical_domain": "redteam.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:RedTeam construction software PHP2Shell", "https://redteam.com/security/ (fetch failed, client error)", "https://redteam.com/", "https://redteam.com/blog/ (fetch failed, client error)", "http://blog.redteam.com" ], "last_checked_utc": "2026-10-23T00:26:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status link in site navigation; blog newest post October 20, 2026 is about switching software, no PHP mention. Search results for this name return redteammonitor.com, an unrelated security news site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "rent-manager", "company": "Rent Manager", "canonical_domain": "rentmanager.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Rent Manager PHP2Shell", "https://www.rentmanager.com/ (homepage, Data Security and Blog links, no trust, status or newsroom link, no notice)", "https://www.rentmanager.com/data-security/ (data security page, no PHP or CVE mention, no status link)" ], "last_checked_utc": "2026-10-23T02:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page is linked. No PHP2Shell item on the homepage or data security page.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "rentredi", "company": "RentRedi", "canonical_domain": "rentredi.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:RentRedi PHP2Shell", "https://rentredi.com/ (homepage, no security, trust or status link, no notice)", "https://rentredi.com/media (news coverage, newest item September 10, 2026, none on PHP)" ], "last_checked_utc": "2026-10-23T02:13:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from rentredi.com. No PHP2Shell item found.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "rentvine", "company": "Rentvine", "canonical_domain": "rentvine.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": true, "statement_url": "https://www.rentvine.com/blog/php-vulnerability-notice--rentvine-protection", "statement_date": "Last updated: Thursday, October 22, 2026", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "search:Rentvine PHP2Shell", "https://www.rentvine.com/ (homepage, no security, trust or status link)", "https://www.rentvine.com/blog (blog, newest post \"PHP Vulnerability Notice & Rentvine Protection\")", "https://www.rentvine.com/blog/php-vulnerability-notice, rentvine-protection (statement)", "https://status.rentvine.com/ (status page, no incident text in the fetch)" ], "last_checked_utc": "2026-10-23T02:11:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Both Rentvine and PMW have been patched and secured against the recent PHP vulnerabilities,", "notes": "\"Both Rentvine and PMW have been patched and secured against the recent PHP vulnerabilities,\" (CVE-2026-109618 and CVE-2026-109619) and \"The patches apply across Rentvine and PMW, including PMW-hosted websites and the Rentvine resident and owner portals\" and \"There's nothing you need to do.\" quoted from https://www.rentvine.com/blog/php-vulnerability-notice, rentvine-protection (by Rentvine Team). Page title tag reads \"PHP vulnerability and Rentvine not affected\"; body says patched. No PHP versions, restarts or EOL branches named. PMW is Property Manager Websites.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "resellerclub", "company": "ResellerClub", "canonical_domain": "resellerclub.com", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.resellerclub.com/ (no banner", "no status page linked)", "https://www.resellerclub.com/blog (newest post 10 Oct 2026, no PHP post)", "https://helpdesk.resellerclub.com/ (login page only)", "https://forums.resellerclub.com/ (fetch failed, robots_disallowed)", "search:ResellerClub PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:33:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Nothing found on the homepage, blog or helpdesk (login only); the forums/Pulse page could not be fetched (robots_disallowed). The compilation pages list ResellerClub with no statement found (reported by activeset.co 22 Oct 2026).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "resman", "company": "ResMan", "canonical_domain": "resman.co", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:ResMan PHP2Shell", "https://resman.co/ (302 redirect to https://www.myresman.com/)", "https://www.myresman.com/ (homepage, blog and News & Awards links, no security, trust or status link, no notice)" ], "last_checked_utc": "2026-10-23T02:13:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "resman.co redirects to myresman.com. No security, trust or status page is linked. No PHP2Shell item found.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "resnexus", "company": "ResNexus", "canonical_domain": "resnexus.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:ResNexus PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.resnexus.com/ (homepage", "no security, trust or status link)", "https://www.resnexus.com/news/ (newest item August 14, 2024", "page banner points to a newer version at resnexus.us/education, not opened)", "https://www.resnexus.com/pci-compliance.html (PCI compliance page, no PHP mention)", "https://status.resnexus.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Only compliance marketing pages (PCI, GDPR) are linked; no security advisory or status page located.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "revenova", "company": "Revenova", "canonical_domain": "revenova.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Revenova PHP2Shell", "https://www.revenova.com/", "https://revenova.com/resources/news/" ], "last_checked_utc": "2026-10-23T02:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page on revenova.com; news page is also the blog. Newest item 17 September 2026. Nothing on PHP2Shell. Search (run 2026-10-23T02:20Z) returned no Revenova-specific result.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "reynolds-and-reynolds", "company": "Reynolds and Reynolds", "canonical_domain": "reyrey.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Reynolds and Reynolds PHP2Shell", "https://www.reyrey.com/ (loaded metadata only, no body content)", "https://www.reyrey.com/company/news (fetch failed, client error)", "https://www.reyrey.com/security (fetch failed, client error)", "https://www.reyrey.com/newsroom (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T00:38:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Company site did not return readable page content on four attempts; search returned no Reynolds and Reynolds PHP2Shell item.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "rms-cloud", "company": "RMS Cloud", "canonical_domain": "rmscloud.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:RMS Cloud PHP2Shell", "https://www.rmscloud.com/ (homepage)", "https://www.rmscloud.com/support/security-at-rms (security page, \"Last Reviewed: October 2026\", no PHP or CVE mention)", "https://rmscloud.statuspage.io/ (status page)", "https://www.rmscloud.com/news (newest item 16 September 2026)", "https://www.rmscloud.com/product-releases (undated items, newest Q2 2026 Product Update)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for 20 and 21 October 2026 and \"No incidents reported today.\" for 22 October 2026, quoted from https://rmscloud.statuspage.io/. Trust center https://trust.rmscloud.com/ linked but not opened.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "rocket-matter", "company": "Rocket Matter", "canonical_domain": "rocketmatter.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Rocket Matter PHP2Shell", "https://www.rocketmatter.com/security/ (fetch failed, client error)", "https://status.rocketmatter.com/ (fetch failed, robots disallowed)", "https://www.rocketmatter.com/ (homepage, no security, trust or status link in header or footer, no notice)", "https://www.rocketmatter.com/blog/category/company-news/ (company news, newest dated item July 9, 2024)" ], "last_checked_utc": "2026-10-23T02:06:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No PHP2Shell item on the homepage or company news; the newest company-news post is dated July 9, 2024.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "rocket-net", "company": "Rocket.net", "canonical_domain": "rocket.net", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://status.rocket.net/incident/3178", "statement_date": "Resolved Oct 22, 2026 06:36 EDT; Recovering Oct 22, 2026 05:17 EDT", "status": "patching", "fixed_version_named": "yes: patches for PHP 5.2 through 8.5 (branches); notes 8.3.35 and 8.4.26 may show as backported builds", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://status.rocket.net/incident/3178", "https://status.rocket.net/", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:28:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Patches from upstream vendors have been released and are currently being deployed across the fleet in rolling waves.", "notes": "\"Patches from upstream vendors have been released and are currently being deployed across the fleet in rolling waves.\" quoted from https://status.rocket.net/incident/3178 (title: PHP Update). Incident marked Resolved at Oct 22, 2026 06:36 EDT with a thank-you note only; no update states deployment finished, so recorded as patching. Patches apply to PHP 5.2 through 8.5; customers advised to move to PHP 8.2 or later via Mission Control; Cloudflare Enterprise WAF named as an extra layer.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Rocket.net affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Rocket.net’s PHP hosting was in scope, and Rocket.net now marks its patching incident as resolved. As of October 23, 2026, its official “PHP Update” notice reports: Patch rollout: October 22 at 5:17 a.m. EDT, upstream security patches were being deployed across its fleet, covering PHP 5.2–8.5. Resolved: The incident was marked resolved on October 22, 2026, at 6:36 a.m.", "cited_urls": [ "https://status.rocket.net/incident/3178" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Rocket.net affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on the search results, here is what is known about PHP2Shell and Rocket.net: What Is PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code on a web server without logging in. The PHP security team rates both CVSSv4.0 9.2 and says", "cited_urls": [ "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://sansec.io/research/php2shell", "https://www.activeset.co/blog/php2shell-host-status" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Rocket.net affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Rocket.net was affected because PHP2Shell is a PHP-core vulnerability, meaning PHP installations serving web requests—not a specific WordPress host—were in scope. Rocket.net reported on October 21 that it was rolling out patches across every PHP version from 5.2 through 8.5. By October 22, the available source reported Rocket.net’s remediation as underway, but did not explicitly confirm that every", "cited_urls": [ "https://meowapps.com/php2shell-wordpress/", "https://github.com/NCSC-NL/php2shell", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://en.wikipedia.org/wiki/PHP2Shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619", "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://blog.securelayer7.net/php-rce-cve-2026-109618-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is Rocket.net affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Rocket.net was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and it has deployed rolling patches across its server fleet. Status & Patching Details Affected Status: All PHP versions from 5.2 through 8.5 across Rocket.net infrastructure were exposed to the core PHP remote code execution (RCE) flaws. Patch Rollout: Rocket.net initiated rolling wave deployments of upstream security patches", "cited_urls": [ "https://meowapps.com/php2shell-wordpress/", "https://status.rocket.net/incident/3178" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Rocket.net affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Rocket.net is rolling out patches for all hosted PHP versions (ranging from PHP 5.2 through PHP 8.5) to address the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Key Details from Rocket.net's Status / Rollout Status: Currently rolling out updates across their infrastructure. Affected PHP Versions: Covers PHP versions from 5.2 to 8.5. How to Verify: Your exposed PHP version number may", "cited_urls": [ "https://meowapps.com/php2shell-wordpress/" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null } ] }, { "slug": "roomkeypms", "company": "RoomKeyPMS", "canonical_domain": "roomkeypms.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:RoomKeyPMS PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.roomkeypms.com/ (homepage)", "https://roomkeypms.com/responsible-disclosure-policy/ (disclosure policy, no PHP vulnerability or patch mention)", "https://roomkeypms.com/news/category/news/ (newest item July 30, 2025)", "https://status.roomkeypms.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security advisory, trust or status page linked from the site; the footer offers a Responsible Disclosure Policy only.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "roommaster", "company": "roommaster", "canonical_domain": "roommaster.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:roommaster PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.roommaster.com/ (homepage", "no security, trust or status link)", "https://www.roommaster.com/blog (newest posts dated October 22, 2026", "listing dates inconsistent, same posts also shown as October 19)", "https://www.roommaster.com/news (newest items October 19, 2026)", "https://www.roommaster.com/security (fetch failed, client error)", "https://status.roommaster.com/ (fetch failed, robots disallowed)", "https://www.roommaster.com/blog/ai-assistants-hotel-daily-operations (newest post, dated October 19, 2026 on the post, no PHP mention", "rechecked 2026-10-23T02:22Z)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Newest blog posts (AI assistants and PMS to AI platform connectors) show no PHP mention in the listing.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "roomraccoon", "company": "RoomRaccoon", "canonical_domain": "roomraccoon.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:RoomRaccoon PHP2Shell", "https://roomraccoon.com/ (homepage", "footer has no security or status link)", "https://roomraccoon.com/blog/ (newest post September 3, 2026)", "https://roomraccoon.com/press-releases/ (newest item October 6, 2025)", "https://roomraccoon.com/release-26-5-whats-new-in-roomraccoon/ (release note, undated, no PHP mention)", "https://status.roomraccoon.com/ (status page)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page reads \"We're not aware of any issues affecting our systems.\" quoted from https://status.roomraccoon.com/; history page not opened.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "rose-rocket", "company": "Rose Rocket", "canonical_domain": "roserocket.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.roserocket.com/", "https://www.roserocket.com/solutions/security", "https://www.roserocket.com/responsible-disclosure" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. Security page is a SOC 2 marketing page; responsible disclosure page has no advisories. No status page, blog or newsroom linked from the homepage. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "roundcube", "company": "Roundcube", "canonical_domain": "roundcube.net", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://roundcube.net/news/ (newest: Security updates 1.6.20 and 1.7.5 released 19 October 2026, pre-dating PHP2Shell, nothing on PHP2Shell)", "https://github.com/roundcube/roundcubemail/releases (snapshot newest 1.7.4, 6 Sep, nothing on PHP2Shell)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Roundcube Webmail listed Vulnerable", "Roundcube Docker image family listed Vulnerable, unrebuilt variants)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Roundcube statement on PHP2Shell found in the project news or release notes as of the last check. NCSC-NL inventory lists Roundcube Webmail and its Docker image family as Vulnerable on the basis of PHP requirements and unrebuilt images, not a project statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "runcloud", "company": "RunCloud", "canonical_domain": "runcloud.io", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://runcloud.io/ (no banner)", "https://blog.runcloud.io/ (redirects to https://runcloud.io/blog, newest post 16 Oct 2026)", "https://status.runcloud.io/ (only a High Server Load incident on 22 Oct 2026)", "search:RunCloud PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:32:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Nothing found on the homepage, blog or status page. Status page incident of Oct 22, 2026 (High Server Load, resolved 12:14pm UTC) does not mention PHP.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "runsensible", "company": "RunSensible", "canonical_domain": "runsensible.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:RunSensible PHP2Shell", "https://www.runsensible.com/", "https://www.runsensible.com/legal/security/ (last modified 2024-07-15)", "https://www.runsensible.com/blog/", "https://www.runsensible.com/blog/legal-deadline-verification-checklist/ (blog post dated October 22, 2026, no PHP content)" ], "last_checked_utc": "2026-10-23T00:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page linked from the homepage.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "sage-300-cre", "company": "Sage 300 CRE", "canonical_domain": "sage.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Sage 300 CRE PHP2Shell", "search:Sage PHP2Shell CVE-2026-109618", "search:Sage security advisories trust center PHP October 2026", "https://www.sage.com/en-us/trust-and-security/ (fetch failed, client error)", "https://www.sage.com/en-gb/trust-and-security/ (fetch failed, client error)", "https://www.sage.com/en-us/trust-and-security/security/ (fetch failed, client error)", "https://www.sage.com/en-us/news/press-releases/", "https://status.sage.com/", "https://www.sage.com/en-us/blog/" ], "last_checked_utc": "2026-10-23T00:19:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Sage trust and security hub blocked the fetch; press releases newest 1 Oct 2026; status.sage.com shows only availability incidents 21 to 22 Oct 2026 with no PHP or security wording; blog newest 2 Oct 2026.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "salesforce-sales-cloud", "company": "Salesforce Sales Cloud", "canonical_domain": "salesforce.com", "group": "index_vendor", "index_category": "crm", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://status.salesforce.com/generalmessages/20000267", "search:Salesforce PHP2Shell", "https://security.salesforce.com/security-advisories (302 redirect to https://status.salesforce.com/, Trust Status app, needs JavaScript)", "https://status.salesforce.com/generalmessages/20000267 (Trust general message, page needs JavaScript)", "https://api.status.salesforce.com/v1/generalMessages/20000267 (the same general message as published data, read in full)", "https://www.softwareinsights.dev/posts/php2shell-php-rce-cve-2026-109618-109619-salesforce-impact/ (third party, CloudCounsel)" ], "last_checked_utc": "2026-10-23T02:04:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Salesforce's status page carries a general message dated 2026-10-21 (created 2026-10-21T20:12:34Z) saying it is \"aware of and actively monitoring\" the flaws and has \"no evidence of exploitation affecting Salesforce or customer data\"; it states no patched, affected or not affected status, so no status statement is recorded. Quoted from https://status.salesforce.com/generalmessages/20000267. Statement found but it states no fix, mitigation or affected status, so none of the fix statuses applies; recorded as no public statement located on fix status. Trust message \"Security Advisory: PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)\": \"At this time, we have no evidence of exploitation affecting Salesforce or customer data.\" and \"For additional context, please review the Official PHP Security Advisory.\" quoted from https://status.salesforce.com/generalmessages/20000267 (createdAt 2026-10-21T20:12:34Z). Reported by CloudCounsel (softwareinsights.dev) October 22, 2026, citing the same Trust notice.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "sap-transportation-management", "company": "SAP Transportation Management", "canonical_domain": "sap.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:SAP PHP2Shell CVE-2026-109618 security note", "search:SAP CVE-2026-109618 PHP2Shell", "https://www.sap.com/about/trust-center/security.html", "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html", "https://support.sap.com/en/my-support/knowledge-base/security-notes-news/security-notes-october-2026.html (fetch failed, robots disallowed)", "https://news.sap.com/" ], "last_checked_utc": "2026-10-23T00:21:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "SAP trust center security page and Security Notes news page do not mention PHP or the CVEs; the October 2026 security notes page could not be fetched. SAP News posts dated 20 and 21 October 2026 (Q3 results, LeanIX, CX, learning) are not about security. Reported by Z_ABAP_NAMESPACE (third-party blog, not affiliated with SAP) 2026-10-21: it found no SAP advisory or note about these CVEs.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "scalahosting", "company": "ScalaHosting", "canonical_domain": "scalahosting.com", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.scalahosting.com/blog/ (no PHP post)", "https://status.scalahosting.com/ (fetch failed, robots_disallowed)", "https://www.scalahosting.com/ (no banner)", "https://www.scalahosting.com/kb/ (no article)", "search:ScalaHosting PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:18:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Nothing found on the blog, homepage or knowledge base; the status page could not be fetched (robots_disallowed).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "sectra", "company": "Sectra", "canonical_domain": "sectra.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Sectra PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://sectra.com/", "https://sectra.com/news-and-press-releases/ (newest 15 Oct 2026)", "https://medical.sectra.com/ (no product security or status page linked)", "https://sectra.com/legal/ (linked, not opened)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No product security advisory page, trust center or status page linked from sectra.com or medical.sectra.com. Newest press item (15 Oct 2026) concerns a secure phone approval, not PHP.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "sera-systems", "company": "Sera Systems", "canonical_domain": "serasystems.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Sera Systems PHP2Shell", "https://www.serasystems.com/ (302 redirect to https://sera.tech/)", "https://sera.tech/ (homepage", "footer has no security, trust or status link)", "https://sera.tech/resources (blog, posts undated, none on PHP)", "https://sera.tech/security (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "serasystems.com redirects to sera.tech. No security, trust or status page is linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "servebolt", "company": "Servebolt", "canonical_domain": "servebolt.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://serveboltstatus.com/incidents/cbbr0l6tkgh9", "statement_date": "Resolved Oct 22, 00:56 CEST (Monitoring Oct 21, 10:58 CEST)", "status": "patched", "fixed_version_named": "yes: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 (7.3 to 8.1 patched without version numbers)", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://status.servebolt.com/ (redirects to https://serveboltstatus.com/)", "https://serveboltstatus.com/", "https://servebolt.com/blog/ (fetch failed, server_error)", "search:Servebolt PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "PHP security updates have been deployed for PHP versions 8.2 to 8.5.", "notes": "\"PHP security updates have been deployed for PHP versions 8.2 to 8.5.\" (Oct 21, 17:30 CEST), \"The PHP security updates have now been deployed for PHP versions 7.3 to 8.1 as well.\" (Oct 21, 23:10 CEST) and \"The temporary mitigations have been removed and the incident is now considered fully resolved.\" (Oct 22, 00:56 CEST) quoted from https://serveboltstatus.com/ (incident: Major PHP security issue; Servebolt's status site). Fixed versions 8.2.35, 8.3.36, 8.4.27, 8.5.12 named at 16:58 CEST. Blog could not be fetched.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "service-fusion", "company": "Service Fusion", "canonical_domain": "servicefusion.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.servicefusion.com/", "https://status.servicefusion.com/", "https://www.servicefusion.com/press", "https://www.servicefusion.com/blog" ], "last_checked_utc": "2026-10-23T01:24:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Status page shows no incidents 20 to 22 Oct 2026; press newest item October 14, 2020; blog newest post Oct 20, 2026 (HVAC tools); no security page link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "servicem8", "company": "ServiceM8", "canonical_domain": "servicem8.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:ServiceM8 PHP2Shell", "https://www.servicem8.com/ (homepage", "footer has no security or status link)", "https://blog.servicem8.com/ (blog, newest post September 2026, ServiceM8 15 launch)", "https://www.servicem8.com/press-media (newest release 11/21/2025)", "https://www.servicem8.com/security (fetch failed, client error)", "https://status.servicem8.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "servicemax", "company": "ServiceMax", "canonical_domain": "servicemax.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:ServiceMax PHP2Shell", "https://www.servicemax.com/ (302 redirect to https://www.ptc.com/en/products/servicemax)", "https://www.ptc.com/en/products/servicemax (product page, no PHP mention)", "https://www.ptc.com/en/about/trust-center (PTC Trust Center, no PHP or CVE mention", "links Advisory Center)", "https://www.ptc.com/en/about/trust-center/advisory-center (PTC Advisory Center", "newest advisory CVE-2026-12569 published 6/18/2026", "no PHP, PHP2Shell, PHP CVE or ServiceMax item)", "https://www.ptc.com/en/news (newest dated item 29 Jul 2026)", "https://www.ptc.com/en/products/servicemax/whats-new (release items undated, no PHP mention)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "ServiceMax is a PTC product; servicemax.com redirects to ptc.com. PTC's Advisory Center lists product advisories (newest published 6/18/2026) and a third-party NPM supply-chain note; none concerns PHP.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "servicepower", "company": "ServicePower", "canonical_domain": "servicepower.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:ServicePower PHP2Shell", "https://www.servicepower.com/ (homepage)", "https://www.servicepower.com/trust-center (trust center, no CVE or dated advisory)", "https://www.servicepower.com/newsroom (newest item Oct. 20, 2026)", "https://www.servicepower.com/blog/servicepower-successfully-completes-soc-2-audit-for-sixth-consecutive-year (post dated October 20, 2026, SOC 2 audit, no PHP mention)", "https://www.servicepower.com/blog (newest post Oct 20, 2026)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Newest post (October 20, 2026) announces a SOC 2 audit completion and does not mention PHP. No status page linked.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "servicetitan", "company": "ServiceTitan", "canonical_domain": "servicetitan.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.servicetitan.com/", "https://www.servicetitan.com/legal/security", "https://www.servicetitan.com/press", "https://status.servicetitan.com/", "https://security.servicetitan.com/" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Security page and Smart Trust Center have no PHP mention or dated notice; status page shows no incidents 20 to 22 Oct 2026; press newest item October 13, 2026.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "servicetrade", "company": "ServiceTrade", "canonical_domain": "servicetrade.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://servicetrade.com/", "https://servicetrade.com/company-news/", "https://servicetrade.com/resources/blog/", "https://servicetrade.com/servicetrades-next-chapter-a-message-from-billy-marshall/ (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust or status link in site navigation; company news and blog listings undated, newest items are leadership announcements (co-founder returns as CEO); no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "shepherd", "company": "Shepherd", "canonical_domain": "shepherd.vet", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.shepherd.vet/", "https://www.shepherd.vet/security/ (fetch failed)", "https://www.shepherd.vet/blog/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or status page linked from the homepage. Newest blog post 16 October 2026; a 4 September 2026 post covers SOC 2. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "shopware", "company": "Shopware", "canonical_domain": "shopware.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.shopware.com/en/changelog/ (newest 6.7.15.1 and 6.6.10.29, 7 Oct 2026)", "https://www.shopware.com/en/news/ (newest 13 Oct 2026)", "https://www.shopware.com/en/security/ (404)", "https://forum.shopware.com/latest", "https://forum.shopware.com/t/kritische-sicherheitsluecken-cvss-9-2-in-php-release-heute-16-00-uhr/109751 (community thread, no Shopware staff post visible)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Shopware 6 and Shopware 5 listed Vulnerable citing requirement docs only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No shopware AG statement on PHP2Shell found in the changelog, news or forum as of the last check. The community forum thread \"Kritische Sicherheitslücken (CVSS 9.2.) in PHP: Release heute 16:00 Uhr\" (opened 21 Oct 2026 by user MichaelF, 33 replies) carries no post marked as Shopware staff on the page read. NCSC-NL inventory lists Shopware 6 and Shopware 5 as Vulnerable on the basis of PHP requirements, not a vendor statement.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Shopware affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Shopware deployments running vulnerable PHP are affected, and Shopware has patched its SaaS offering. Self-hosted installations need their own PHP update. As of October 23, 2026: | Deployment | Status | |---|---| | Shopware SaaS | Patched. Shopware marked its update complete on October 21, 2026, at 14:33 UTC, stating: “All shops have been updated to the latest PHP", "cited_urls": [ "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_s.md", "https://status.shopware.com/history/1", "https://www.php.net/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Shopware affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of what is known about PHP2Shell (CVE-2026-109618 & CVE-2026-109619) and its impact on Shopware: PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Is Shopware Affected? ✅ Yes — Shopware Is Affected The flaws are in the PHP engine itself, so Magento, Shopware, and WooCommerce stores are affected even when their own code is clean. This is a critical", "cited_urls": [ "https://sansec.io/research/php2shell", "https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://www.czargroup.net/blog/php2shell-cve-2026-109618-cve-2026-109619-for-magento-2-adobe-commerce-and-woocommerce/", "https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Shopware affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Shopware is affected when it runs on a vulnerable, web-serving PHP runtime, but the vulnerabilities are in PHP itself—not in Shopware code. The NCSC-NL software list explicitly marks both Shopware 5 and Shopware 6 as vulnerable in that deployment scenario. PHP fixed CVE-2026-109618 and CVE-2026-109619 on 21 October 2026 in: PHP 8.2.35 PHP 8.3.36 PHP 8.4.27 PHP 8.5.12", "cited_urls": [ "https://tobias-schaefer.com/blog/php2shell/", "https://sn1persecurity.com/wordpress/php2shell-cve-2026-109618-php-core-rce-detection-with-sn1per/", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_s.md", "https://github.com/NCSC-NL/php2shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md", "https://sansec.io/research/php2shell", "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:33.102Z", "question": "Is Shopware affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Shopware is indirectly affected because it runs on top of the PHP runtime, which contains the core vulnerabilities CVE-2026-109618 and CVE-2026-109619 (known as PHP2Shell). However, the vulnerability is not a flaw in Shopware's own application code, but rather a memory-safety and remote code execution bug in the underlying PHP interpreter . Affected Status Vulnerable: Any Shopware instance running on", "cited_urls": [ "https://www.wiz.io/blog/php2shell-php-rce", "https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://en.wikipedia.org/wiki/PHP2Shell", "https://aws.amazon.com/security/security-bulletins/2026-143-aws/", "https://success.trendmicro.com/en-US/solution/KA-0024789", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Shopware affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Are Shopware stores affected? Yes, Shopware stores running on vulnerable versions of the PHP core engine are affected because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability in the underlying PHP language runtime rather than Shopware's own application code. Even if a Shopware installation is clean and up to date, the underlying server environment remains at risk if it runs", "cited_urls": [ "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://sansec.io/research/php2shell", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "sibro", "company": "SIBRO", "canonical_domain": "sibro.xyz", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:SIBRO PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.sibro.xyz/ (302 redirect to https://sibro.app/)", "https://sibro.app/ (homepage", "no security, trust or status link)", "https://sibro.app/insights/ (newest post 10 Oct 2026)", "https://sibro.app/updates/ (newest product update 05 Oct 2026, no PHP mention)", "https://sibro.app/security/ (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "sibro.xyz redirects to sibro.app.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "siemens-healthineers", "company": "Siemens Healthineers", "canonical_domain": "siemens-healthineers.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Siemens Healthineers PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://www.siemens-healthineers.com/", "https://www.siemens-healthineers.com/support-documentation/cybersecurity (newest advisory February 10, 2026)", "https://www.siemens-healthineers.com/press/releases (listing rendered without items)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Cybersecurity page lists product security advisories (newest SSA-016040, 10 February 2026) and incident statements; no PHP item. Press release listing did not render items on fetch.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "simplifyem", "company": "SimplifyEm", "canonical_domain": "simplifyem.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:SimplifyEm PHP2Shell", "search:SimplifyEm PHP2Shell CVE-2026-109618", "https://www.simplifyem.com/ (fetch failed)", "https://simplifyem.com/", "https://www.simplifyem.com/features-pricing/", "https://www.simplifyem.com/blog/" ], "last_checked_utc": "2026-10-23T00:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page found on the site. Blog posts are undated and none concern security. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "simpro", "company": "simpro", "canonical_domain": "simpro.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.simpro.com/", "https://www.simprogroup.com/", "https://status.simprogroup.com/", "https://www.simprogroup.com/company/press", "https://www.simprogroup.com/blog" ], "last_checked_utc": "2026-10-23T01:24:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. simpro.com homepage shows no security, status or news links; Simpro Group site checked as well: status page newest incident Datafeed Service Outage Oct 20, 2026 (not described as security); press newest September 30, 2026; blog newest October 22, 2026; no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "siteground", "company": "SiteGround", "canonical_domain": "siteground.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026", "statement_date": "Oct 21, 2026 (body: Last updated: 21 October 2026, 11:30 UTC)", "status": "mitigation only", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "rolled out server-level mitigation rules across all SiteGround servers.", "notes": "\"rolled out server-level mitigation rules across all SiteGround servers.\" \"We disabled the affected functionalities on all supported PHP versions.\" \"You don't need to update anything or change your PHP version.\" quoted from https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026 (author Aleksandar Kolev). Post written before the 14:00 UTC release; body says \"We'll update this post once PHP publishes its security release.\" No visible update on patched builds as of this check (page metadata modified 2026-10-22T07:00:49+00:00).", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is SiteGround affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "SiteGround says it has patched both CVE-2026-109618 and CVE-2026-109619 across all its servers, and hosted customers are protected. Its latest advisory update is dated October 22, 2026, at 12:00 UTC. Affected? SiteGround treated the vulnerabilities as applicable to its PHP environment and initially disabled affected functionality across all supported PHP versions. It now reports that customers are protected—not that", "cited_urls": [ "https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is SiteGround affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes — SiteGround was affected by PHP2Shell, and it has confirmed that patches are fully applied. Here is a detailed breakdown: What is PHP2Shell? PHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). Both are rated 9.2 on the CVSS v4.0 scale. CVE-2026-109618 – RCE via OOM corruption:", "cited_urls": [ "https://en.wikipedia.org/wiki/PHP2Shell", "https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://sansec.io/research/php2shell", "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is SiteGround affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—SiteGround says its customers were protected before the official PHP fixes, through server-level mitigations that disabled the affected functionality across its servers. After PHP released the patches on October 21, 2026, SiteGround says it applied the official fixes across all servers. The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. SiteGround states that hosted customers do not need", "cited_urls": [ "https://www.siteground.com/es/blog/vulnerabilidad-php-critica-octubre-2026", "https://newblog.siteground.com/en/category/product-updates/", "https://newblog.siteground.com/en/", "https://x.com/SiteGround/status/2112885895053320538", "https://php2shellcheck.com/hosting-status/", "https://mallory.ai/blog/php-rce-rapid-response", "https://www.digitalapplied.com/blog/php2shell-fixes-by-distro-control-panel-php-version", "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/hkoeck/php2shell-status" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is SiteGround affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, SiteGround is protected and has already applied the necessary patches across all of its servers. Key Details Status: SiteGround mitigated the issue at the server level prior to the release and applied PHP's official patches across all supported PHP versions on October 21, 2026. Action Required: None. SiteGround manages PHP updates at the server level, so hosted websites", "cited_urls": [ "https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is SiteGround affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact on SiteGround: Sites hosted on SiteGround were protected prior to the official release of the patches through proactive server-level mitigations, and official fixes were applied immediately after PHP released updated versions. Action Required: Clients do not need to perform any manual updates, change settings, or switch PHP versions. Source: Official details and confirmation are available on the SiteGround", "cited_urls": [ "https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "smartsheet", "company": "Smartsheet", "canonical_domain": "smartsheet.com", "group": "index_vendor", "index_category": "project_management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Smartsheet PHP2Shell", "https://www.smartsheet.com/trust (trust page, no PHP or CVE mention, no status link)", "https://status.smartsheet.com/ (status page)", "https://www.smartsheet.com/content-center/news (newest item Oct 8, 2026, none on PHP)" ], "last_checked_utc": "2026-10-23T02:16:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for October 20 and 21 and \"No incidents reported today.\" for October 22, 2026, quoted from https://status.smartsheet.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "smokeball", "company": "Smokeball", "canonical_domain": "smokeball.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Smokeball PHP2Shell", "https://www.smokeball.com/security (security policy, \"Last updated 07/09/2026\", no PHP or CVE mention, no status or trust link)", "https://status.smokeball.com/ (status page)", "https://www.smokeball.com/blog (newest post Oct 20, 2026, Smokeball Spark 2026 recap, none on PHP)" ], "last_checked_utc": "2026-10-23T02:07:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for Oct 20 and Oct 21, 2026 and \"No incidents reported today.\" for Oct 22, 2026, quoted from https://status.smokeball.com/. Newest blog post (Oct 20, 2026) is a conference recap.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "sophos", "company": "Sophos", "canonical_domain": "sophos.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell", "statement_date": "2026 Oct 21 (Updated 2026 Oct 22, Article Version 4)", "status": "not affected", "fixed_version_named": "yes: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (PHP project fixes cited; no Sophos product update needed)", "workers_restart_stated": "yes", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Sophos MyUTM portal listed Investigation citing this advisory)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Advisory sophos-sa-20261021-php2shell \"Advisory: PHP2Shell Vulnerabilities (CVE-2026-109618, CVE-2026-109619)\": \"No Sophos products are affected by these vulnerabilities.\" Mixed: the legacy Sophos-hosted MyUTM licensing portal for end-of-life SG UTM ran an affected PHP version; \"Sophos took the portal offline on October 21, 2026 and is updating it before restoring service.\" No evidence of exploitation found, log review ongoing. IPS signatures for Sophos Firewall and Endpoint released 22 Oct 2026; Firewall WAF has no specific protection. Guidance for customers' own PHP apps: \"Restart all PHP workers after any configuration change.\"; PHP 8.1 and earlier are end-of-life and remain vulnerable. All quotes from the statement URL.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "spinupwp", "company": "SpinupWP", "canonical_domain": "spinupwp.com", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://spinupwp.com/ (no banner)", "https://spinupwp.com/blog/ (newest post 22 May 2026)", "https://status.spinupwp.com/ (No incidents reported 20 to 22 Oct 2026)", "https://spinupwp.com/whats-new/ (no PHP security item)", "search:SpinupWP PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:34:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Nothing found on the homepage, blog, status page or What's New page.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "statamic", "company": "Statamic", "canonical_domain": "statamic.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://statamic.com/blog (newest post 14 Oct 2026, nothing on PHP2Shell)", "https://statamic.com/releases (404)", "https://github.com/statamic/cms/releases (newest v6.35.0, 1 Oct 2026, nothing on PHP2Shell)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Statamic CMS listed Vulnerable citing requirements only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Statamic statement on PHP2Shell found in its newsroom or release notes as of the last check. NCSC-NL inventory lists Statamic CMS as Vulnerable on the basis of PHP requirements, not a vendor statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "stayntouch", "company": "Stayntouch", "canonical_domain": "stayntouch.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Stayntouch PHP2Shell", "https://www.stayntouch.com/ (homepage", "no security or status link)", "https://www.stayntouch.com/news/ (newest item October 7, 2026)", "https://www.stayntouch.com/blog/ (newest post September 25, 2026)", "https://stayntouch.freshdesk.com/support/discussions/forums/24000000188 (product updates, newest v6.12 posted 9 days ago, no PHP mention)", "https://www.stayntouch.com/security/ (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "successware", "company": "Successware", "canonical_domain": "successware.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Successware PHP2Shell", "https://www.successware.com/ (homepage", "footer has no security or status link)", "https://www.successware.com/blog/ (newest post Jul 30, 2024)", "https://www.successware.com/in-the-news/ (newest item Aug 06, 2024)", "https://www.successware.com/security/ (fetch failed, client error)", "https://status.successware.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from the site; blog and news last updated 2024.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "suitecrm", "company": "SuiteCRM", "canonical_domain": "suitecrm.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://community.suitecrm.com/t/upcoming-critical-php-security-release/101375", "statement_date": "21 October 2026, 09:45 (follow-ups 21 October 2026, 13:24 and 16:01)", "status": "customer must update", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://suitecrm.com/blog/ (404)", "https://community.suitecrm.com/latest", "https://community.suitecrm.com/t/upcoming-critical-php-security-release/101375", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (SuiteCRM listed Vulnerable citing compatibility matrix only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"Upcoming Critical PHP Security Release\" by the suitecrm_team account on SuiteCRM's own community forum (staff label not printed on the page). \"It is server software, not part of SuiteCRM, so updating SuiteCRM will not apply this fix.\" and \"Your PHP version is changed by whoever manages your server.\" quoted from the statement URL. Users told to find out who manages PHP, check the version, back up files and database, stay on a supported PHP branch (unsupported branches should not expect a fix) and watch php.net. SuiteCRM's own post names no CVE or version; its 16:01 follow-up reposts the PHP advisory naming CVE-2026-109618, CVE-2026-109619 and PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. No mention of SalesAgility hosted services.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "symfony", "company": "Symfony", "canonical_domain": "symfony.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://symfony.com/blog/ (posts through 22 Oct 2026, none on PHP2Shell)", "https://symfony.com/blog/category/security-advisories (newest 15 Oct 2026: CVE-2026-108082, CVE-2026-109449, CVE-2026-109413)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Symfony framework listed Vulnerable citing setup docs only)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Symfony statement on PHP2Shell found on the official blog or security advisories list as of the last check. NCSC-NL inventory lists the Symfony framework as Vulnerable on the basis of PHP requirements, not a project statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "sync1-systems", "company": "Sync1 Systems", "canonical_domain": "sync1systems.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Sync1 Systems PHP2Shell", "https://www.sync1systems.com/ (page body not retrievable, metadata only)", "https://sync1systems.com/ (metadata only)", "https://sync1systems.com/news (metadata only)", "https://sync1systems.com/blog (metadata only)", "https://sync1systems.com/security (metadata only)" ], "last_checked_utc": "2026-10-23T01:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Site renders client-side only; every fetch returned page metadata without body text, so no security, status, news or blog content could be read. No statement could be located at the places checked.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "synology", "company": "Synology", "canonical_domain": "synology.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://www.synology.com/en-global/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities", "statement_date": "October 22, 2026", "status": "patched partly", "fixed_version_named": "no", "workers_restart_stated": "yes", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://www.synology.com/en-global/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Synology PHP package families listed Investigation)", "search:Synology PHP2Shell (statement URL supplied by desk)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Statement (Taipei, 22 Oct 2026; advisory Synology-SA-26:14): PHP security updates released through Package Center for DSM 7.4, 7.3 and 7.2 (end of life); no build numbers printed. \"Users of the affected packages are strongly advised to update PHP through Package Center immediately.\" quoted from the statement URL. Mixed: DSM's internal PHP component rated minimal risk, patch scheduled for a later DSM release; DSM earlier than 7.2 told to disable affected packages until patched. Affected packages named: Calendar, IDrive (third party), Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, WordPress; Synology Drive not affected. Dependent packages restart automatically after the PHP update; MailStation needs a manual update in Package Center.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Synology affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Synology is affected, and patches are available, with exceptions. As of October 23, 2026, Synology’s official advisory Synology-SA-26:14, published October 22, lists both CVE-2026-109618 and CVE-2026-109619 as Critical, with status Resolved. That does not mean every installed system is already patched. What is affected? Synology identifies systems running these PHP-dependent packages: Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM,", "cited_urls": [ "https://www.synology.com/en-us/security/advisory/Synology_SA_26_14", "https://www.synology.com/en-global/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Synology affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of Synology's situation regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619), fully sourced: What is PHP2Shell? CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) involves out-of-memory handling that can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid. CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) involves request-owned internal state that can survive after its backing memory", "cited_urls": [ "https://community.synology.com/enu/forum/1/post/231447", "https://www.synology.com/en-global/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities", "https://www.synology.com/en-global/security/advisory/Synology_SA_26_14" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Synology affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Synology is affected, but only when certain PHP-dependent packages are installed and exposed. Synology’s affected list includes PHP 7.3–8.4 packages, Mail Station, Calendar, Joomla, KodExplorer, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, and WordPress; Synology Drive is explicitly not affected. Synology has patched the issue. Its advisory marks PHP2Shell as “Resolved” and provides fixed releases, including PHP 8.0.30-0122, 8.1.34-0120, 8.2.35-0171, 8.3.36-0051,", "cited_urls": [ "https://www.synology.com/en-global/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities", "https://mariushosting.com/synology-mitigating-php2shell-cve-2026-109618-cve-2026-109619/", "https://stadt-bremerhaven.de/synology-sicherheitsupdates-fuer-php-gegen-php2shell-luecken/", "https://appleinsider.com/articles/26/10/22/critical-php-vulnerabilities-threaten-your-nas-not-every-vendor-has-a-fix", "https://www.synology.com/en-global/security/advisory/Synology_SA_26_14", "https://note.com/pc_article/n/n9a45909e7a32?hl=en", "https://mallory.ai/blog/php-rce-rapid-response", "https://ground.news/article/synology-security-updates-for-php-against-php2shell-gaps", "https://www.synology.com/en-us/security/advisory/Synology_SA_26_14", "https://github.com/NCSC-NL/php2shell" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is Synology affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Synology systems running vulnerable PHP versions via Web Station are affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and Synology has released official updated PHP packages in Package Center to address the issue. Affected Status & Patch Details Vulnerability: CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) allow unauthenticated remote code execution on PHP instances handling web requests (such as via Web Station). Patched", "cited_urls": [ "https://mariushosting.com/synology-mitigating-php2shell-cve-2026-109618-cve-2026-109619/", "https://community.synology.com/enu/forum/1/post/231447" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Synology affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Synology NAS units can be affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) if they run web-facing PHP applications via packages like Web Station or phpMyAdmin, though Synology has not yet published an official company product security advisory or rolling out automated global patches for all affected environments as of October 2026. Details on Synology and PHP2Shell Impact Scope:", "cited_urls": [ "https://mariushosting.com/synology-mitigating-php2shell-cve-2026-109618-cve-2026-109619/", "https://community.synology.com/enu/forum/18/post/231457", "https://community.synology.com/enu/forum/1/post/231447", "https://blog.ogwilliam.com/post/php2shell-cve-2026-109618-cve-2026-109619-rce-vulnerability" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "tab32", "company": "tab32", "canonical_domain": "tab32.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.tab32.com/", "https://tab32.com/blog/", "https://tab32.com/press/" ], "last_checked_utc": "2026-10-23T01:17:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust or status link in site navigation; blog newest post October 5, 2026; press newest item March 5, 2024.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "tabs3", "company": "Tabs3", "canonical_domain": "tabs3.com", "group": "index_vendor", "index_category": "legal-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Tabs3 PHP2Shell", "https://www.tabs3.com/ (homepage, no security, trust, status or newsroom link in header or footer, no notice)", "https://www.tabs3.com/blog/ (newest post Sep 28, 2026, none on PHP)" ], "last_checked_utc": "2026-10-23T02:06:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from the site. Tabs3 offers both cloud and on-premises editions; no statement for either was found.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "tai-tms", "company": "Tai TMS", "canonical_domain": "taisoftware.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.taisoftware.com/ (redirects to https://tai-software.com/)", "https://tai-software.com/", "https://tai-software.com/blog/ (articles failed to load on the page)", "https://tai-software.com/support/" ], "last_checked_utc": "2026-10-23T01:15:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or status page on tai-software.com; blog listing returned no articles. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "tekion", "company": "Tekion", "canonical_domain": "tekion.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Tekion PHP2Shell", "https://tekion.com/", "https://tekion.com/trust-portal", "https://status.tekion.com/", "https://tekion.com/news" ], "last_checked_utc": "2026-10-23T00:37:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trust Portal lists no security notices and no PHP mention; status page shows no incidents reported 9 to 23 Oct 2026; news newest item October 20, 2026 is a customer announcement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "temenos", "company": "Temenos", "canonical_domain": "temenos.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Temenos PHP2Shell", "https://www.temenos.com/", "https://www.temenos.com/security/ (Temenos Banking Cloud security page)", "https://www.temenos.com/press_release/uks-kingdom-bank-goes-live-on-temenos-saas-to-accelerate-growth-of-values-led-banking-services/ (newest press release, dated OCTOBER 22, 2026, no PHP content)", "https://www.temenos.com/blogs/ (posts undated)" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No trust center or status page linked from the site. Newest press release (22 October 2026) is a customer go-live announcement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "tenantcloud", "company": "TenantCloud", "canonical_domain": "tenantcloud.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:TenantCloud PHP2Shell", "https://www.tenantcloud.com/ (homepage, no security, trust or status link, no notice)", "https://www.tenantcloud.com/updates (product updates, newest August 6, 2025, none on PHP)", "https://www.tenantcloud.com/blog (newest post September 23, 2026, none on PHP)" ], "last_checked_utc": "2026-10-23T02:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from tenantcloud.com. No PHP2Shell item on the updates page or blog.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "the-mortgage-office", "company": "The Mortgage Office", "canonical_domain": "themortgageoffice.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:The Mortgage Office PHP2Shell", "https://www.themortgageoffice.com/", "https://www.themortgageoffice.com/the-mortgage-office-achieves-soc-2-type-ii-compliance/ (dated October 20, 2025)", "https://www.themortgageoffice.com/type/news/ (newest dated item August 5, 2026)", "https://www.themortgageoffice.com/blog/" ], "last_checked_utc": "2026-10-23T01:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page beyond the SOC 2 announcement; no newsroom item after August 2026.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "thinkreservations", "company": "ThinkReservations", "canonical_domain": "thinkreservations.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:ThinkReservations PHP2Shell", "https://www.thinkreservations.com/ (homepage", "no security or status link)", "https://www.thinkreservations.com/resources/articles (newest article Tuesday, October 20, 2026, DIAMO and Ramsi integrations, no PHP mention)", "https://www.thinkreservations.com/resources/articles/diamo-ramsi-integrations-release (article dated Tuesday, October 20, 2026, no PHP or security patch mention)", "https://www.thinkreservations.com/security (fetch failed, client error)", "https://status.thinkreservations.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Newest article (October 20, 2026) announces revenue management integrations, no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "trello", "company": "Trello", "canonical_domain": "trello.com", "group": "index_vendor", "index_category": "project_management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Trello PHP2Shell", "https://www.atlassian.com/trust/security/advisories (Atlassian security advisories covering Trello, no PHP item)", "https://trello.status.atlassian.com/ (Trello status page)" ], "last_checked_utc": "2026-10-23T02:17:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trello status page shows \"No incidents reported.\" for 20 and 21 October 2026 and \"No incidents reported today.\" for 22 October 2026, quoted from https://trello.status.atlassian.com/. Trello is an Atlassian product; Atlassian's advisory list has no PHP2Shell item.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "trimble-transportation", "company": "Trimble Transportation", "canonical_domain": "trimble.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Trimble PHP2Shell CVE-2026-109618", "https://www.trimble.com/en/our-commitment/responsible-business/security (404)", "https://www.trimble.com/en/news (404)", "https://www.trimble.com/en/our-commitment/trust-center (fetch failed)", "https://www.trimble.com/", "https://www.trimble.com/en/support", "https://www.trimble.com/en/blog/trimble" ], "last_checked_utc": "2026-10-23T00:21:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust center, advisory or status page linked from the trimble.com homepage or support hub; blog landing page returned only metadata. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "trimble-viewpoint", "company": "Trimble Viewpoint", "canonical_domain": "viewpoint.com", "group": "index_vendor", "index_category": "construction-project-management", "statement_found": true, "statement_url": "https://trust.trimble.com/", "statement_date": "October 21, 2026", "status": "patching", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "search:Trimble Viewpoint PHP2Shell", "search:Trimble trust center security advisories bulletins", "https://status.viewpoint.com/", "https://www.trimble.com/en/our-commitment/responsible-business/trust-center (404)", "https://www.viewpoint.com/blog", "https://www.viewpoint.com/", "https://trust.trimble.com/" ], "last_checked_utc": "2026-10-23T00:21:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Trimble is aware of the recently disclosed vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). We are in the process of determining impacted systems and environments, and are applying patches and/or mitigations to Trimble-hosted systems and environments where required.", "notes": "\"Trimble is aware of the recently disclosed vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). We are in the process of determining impacted systems and environments, and are applying patches and/or mitigations to Trimble-hosted systems and environments where required.\" quoted from https://trust.trimble.com/ (Trust Portal Updates entry titled \"Critical security issue affecting PHP (October 21, 2026)\"; no dedicated page URL). Statement is by parent company Trimble and does not name Viewpoint or any product. Mixed: patches and/or mitigations, impacted systems still being determined. status.viewpoint.com shows no PHP item.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "turbotenant", "company": "TurboTenant", "canonical_domain": "turbotenant.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:TurboTenant PHP2Shell", "https://www.turbotenant.com/ (homepage, no security, trust, status or newsroom link, no notice)", "https://www.turbotenant.com/education/ (blog, posts undated, none on PHP)", "https://status.turbotenant.com/ (status page, no incident text in the fetch)" ], "last_checked_utc": "2026-10-23T02:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security or trust page is linked from turbotenant.com. No PHP2Shell item found.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "turnkey-lender", "company": "TurnKey Lender", "canonical_domain": "turnkeylender.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:TurnKey Lender PHP2Shell", "https://www.turnkeylender.com/ (302 redirect to https://www.turnkey-lender.com/)", "https://www.turnkey-lender.com/", "https://www.turnkey-lender.com/information-security/", "https://www.turnkey-lender.com/latest-news/ (newest May 26, 2026)", "https://www.turnkey-lender.com/blog/ (posts undated)" ], "last_checked_utc": "2026-10-23T00:30:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Live site is turnkey-lender.com (turnkeylender.com redirects there). No status page or newsroom beyond Latest News.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "turvo", "company": "Turvo", "canonical_domain": "turvo.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://turvo.com/", "https://turvo.com/security/", "https://turvo.com/resources/news/", "https://turvo.com/resources/articles/" ], "last_checked_utc": "2026-10-23T00:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No trust center or status page linked; /security/ is a marketing page. News and articles undated, none on security. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "typo3", "company": "TYPO3", "canonical_domain": "typo3.org", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://news.typo3.com/article/typo3-psa-2026-001", "statement_date": "21 October 2026", "status": "customer must update", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://typo3.org/security (redirects to https://news.typo3.com/security)", "https://news.typo3.com/security", "https://news.typo3.com/article/typo3-psa-2026-001", "https://typo3.org/article (stale, newest 1 Jul 2025)", "https://typo3.org/security/advisories (fetch failed)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (TYPO3 13.4 listed Vulnerable citing requirements only)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "TYPO3-PSA-2026-001 \"Critical PHP security release: PHP update required for all TYPO3 installations\". \"TYPO3 itself is not affected and does not need to be updated.\" and \"PHP versions prior to 8.2 no longer receive security updates from the PHP project.\" quoted from https://news.typo3.com/article/typo3-psa-2026-001. Self-managed servers, VPS and Docker users told to update PHP without delay; hosting customers to check with their provider. ELTS notes: TYPO3 v11/v12 ELTS on PHP 8.1 and v10 ELTS on PHP up to 7.4 pointed to commercial OS updates such as Ubuntu Pro. No CVE IDs and no PHP patch versions named.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "uber-freight-tms", "company": "Uber Freight TMS", "canonical_domain": "uberfreight.com", "group": "index_vendor", "index_category": "transportation-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.uberfreight.com/", "https://trust.uberfreight.com/ (page returned only metadata)", "https://www.uberfreight.com/newsroom/", "https://www.uberfreight.com/en-US/blog" ], "last_checked_utc": "2026-10-23T00:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. Trust center page rendered only metadata, no advisory text. Newest blog post 12 October 2026; newsroom items undated. No status page found. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "unopim-webkul", "company": "UnoPim (Webkul)", "canonical_domain": "unopim.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://github.com/unopim/unopim/pull/787", "statement_date": "Oct 21, 2026 (opened), merged Oct 22, 2026", "status": "patched", "fixed_version_named": "yes: webkul/unopim and webkul/unopim-queue Docker images (tags 3.1.3, 3.1, latest) rebuilt on PHP 8.4.27", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://github.com/unopim/unopim/releases/tag/v3.1.3 (release dated 29 Sep", "the page read shows no PHP, Docker, CVE or PHP2Shell text)", "https://github.com/unopim/unopim/pull/787", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (UnoPim official Docker images listed Fix on 23 Oct 2026 00:48 CEST citing release v3.1.3 and PR 787)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Merged pull request \"fix(docker): disable session upload progress in php.ini\" (#787) on the project's official GitHub repository by Webkul developer navneetkumar-pim-webkul, citing CVE-2026-109618 and CVE-2026-109619: the published images previously ran PHP 8.4.26 and were rebuilt and republished on PHP 8.4.27; \"Upgrading PHP is the only complete fix.\" quoted from the PR URL. The PR also sets session.upload_progress.enabled = Off in the image php.ini. The v3.1.3 release page read in this run carried no PHP2Shell text, contrary to the NCSC-NL note. Self-hosted non-Docker installs not addressed on the page read.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "unraid-lime-technology", "company": "Unraid (Lime Technology)", "canonical_domain": "unraid.net", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://docs.unraid.net/unraid-os/release-notes/7.4.0/ (7.4.0-rc.1, 2026-10-08, PHP 8.4.26, nothing on PHP2Shell)", "https://unraid.net/blog (newest 15 Oct 2026, nothing on PHP2Shell)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Unraid PHP management runtime distribution listed Investigation citing release notes only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Unraid statement on PHP2Shell found in the release notes or blog as of the last check; the newest release notes read (7.4.0-rc.1, 8 Oct 2026) list PHP 8.4.26, which pre-dates the fixed releases. NCSC-NL inventory lists Unraid as Investigation on the basis of its release notes, not a vendor statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "vercel", "company": "Vercel", "canonical_domain": "vercel.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://vercel.com/kb/bulletin/php2shell-security-bulletin", "statement_date": "undated (fetched 2026-10-23T00:38Z)", "status": "mitigation only", "fixed_version_named": "yes: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://vercel.com/kb/bulletin/php2shell-security-bulletin", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:38:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Vercel deployed WAF protections before public disclosure.", "notes": "\"Vercel deployed WAF protections before public disclosure.\" \"These rules reduce exposure to known exploit patterns, but do not replace patching.\" \"Upgrade the PHP runtime to a patched release immediately, regardless of WAF protections or hosting provider.\" quoted from https://vercel.com/kb/bulletin/php2shell-security-bulletin (title: PHP security advisory: php2shell (CVE-2026-109618, CVE-2026-109619); Author: Security Team; no date printed). WAF rules apply automatically to all projects at no cost, covering PHP functions on Vercel and rewrites/proxies to external PHP backends. \"PHP 8.1 and earlier no longer receive regular updates from the PHP project.\"", "ai_answer_note": null, "ai_answers": [] }, { "slug": "vergent-lms", "company": "Vergent LMS", "canonical_domain": "vergentlms.com", "group": "index_vendor", "index_category": "loan-origination-software", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Vergent LMS PHP2Shell", "https://www.vergentlms.com/", "https://www.vergentlms.com/security/", "https://www.vergentlms.com/news/ (newest January 20, 2026)", "https://www.vergentlms.com/blogs/ (newest June 26, 2026)" ], "last_checked_utc": "2026-10-23T01:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Security page states Vergent carries \"platform patching and monitoring\" under its shared security model (quoted from https://www.vergentlms.com/security/); generic, no advisory. No status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "vertafore", "company": "Vertafore", "canonical_domain": "vertafore.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Vertafore PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.vertafore.com/ (homepage)", "https://www.vertafore.com/current-customers/trust-center (trust center", "service availability figures, no PHP, CVE or advisory)", "https://www.vertafore.com/about/press-releases (newest item Oct 20, 2026, Velocity Coach agent)", "https://www.vertafore.com/resources/press-releases/vertafore-launches-velocity-coach-agent-drive-employee-proficiency (October 20, 2026 product release, no PHP mention", "rechecked 2026-10-23T02:20Z)", "https://www.vertafore.com/blog (newest post October 22, 2026, no PHP mention in listing)", "https://status.vertafore.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Trust center points customers to the MyVertafore support portal for maintenance schedules; no public advisory list.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "vetbadger", "company": "VetBadger", "canonical_domain": "vetbadger.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.vetbadger.com/", "https://www.vetbadger.com/blog", "https://www.vetbadger.com/about" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust, status or newsroom page on vetbadger.com. Newest blog post 19 October 2026 is about client communication. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "vetlinkpro", "company": "VetlinkPRO", "canonical_domain": "vetlinkpro.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.vetlinkpro.com/", "https://vetlinkpro.com/vetlinkpro-online-status-cloud-system-status-service-updates", "https://blog.vetlinkpro.com/vetlinkpro-blog" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. Cloud status page embeds a widget whose contents were not readable as text; no security or trust page; blog posts undated, none on security. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "vetport", "company": "Vetport", "canonical_domain": "vetport.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.vetport.com/", "https://www.vetport.com/resources", "https://www.vetport.com/resources_revamp" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust, status or newsroom page on vetport.com. Newest resource items 31 August 2026. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "vetspire", "company": "Vetspire", "canonical_domain": "vetspire.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.vetspire.com/ (redirects to https://www.vetspire.ai/)", "https://www.vetspire.ai/", "https://www.vetspire.ai/blog" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust, status or newsroom page on vetspire.ai; blog posts undated, none on security. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "via", "company": "VIA", "canonical_domain": "viainfosys.com", "group": "index_vendor", "index_category": "veterinary-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.viainfosys.com/", "https://www.viainfosys.com/news/", "https://www.viainfosys.com/via-safe/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Web search for this company could not be run (shared search budget exhausted); company pages checked instead. No security, trust or status page on viainfosys.com. Newest news item 2 July 2026. Nothing on PHP2Shell.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "visage-imaging", "company": "Visage Imaging", "canonical_domain": "visageimaging.com", "group": "index_vendor", "index_category": "radiology-medical-imaging", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Visage Imaging PHP2Shell (not run: per-turn WebSearch budget exhausted)", "https://visageimaging.com/", "https://visageimaging.com/about/compliance/", "https://visageimaging.com/press-releases/ (newest October 15, 2026)", "https://blog.visageimaging.com/blog (newest August 12, 2026)" ], "last_checked_utc": "2026-10-23T01:40:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security advisory, trust center or status page linked from the site. Homepage embeds LinkedIn posts dated October 17 and 21, 2026 about conference appearances, not PHP.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "visual-matrix", "company": "Visual Matrix", "canonical_domain": "visualmatrix.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Visual Matrix PMS PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.visualmatrix.com/ (homepage)", "https://visualmatrix.com/news/ (newest item September 14, 2026)", "https://visualmatrix.com/security/ (302 redirect to https://help.visualmatrix.com/portal/en/kb/vm-pms-all-users/staying-secure-with-visual-matrix)", "https://help.visualmatrix.com/portal/en/kb/vm-pms-all-users/staying-secure-with-visual-matrix (security knowledge base index, undated, no PHP mention)", "https://status.visualmatrix.com/ (status page)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page shows \"No incidents reported.\" for 20, 21 and 22 Oct 2026, \"All services are online.\" and \"Last updated Oct 23, 2026 at 1:11am UTC\", quoted from https://status.visualmatrix.com/.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "vtiger", "company": "vtiger", "canonical_domain": "vtiger.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.vtiger.com/blog/ (no PHP2Shell content)", "https://community.vtiger.com/ (fetch failed, client error)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Vtiger CRM Open Source listed Vulnerable citing install FAQ only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Vtiger statement on PHP2Shell found as of the last check; the community site could not be read. NCSC-NL inventory lists Vtiger CRM Open Source as Vulnerable on the basis of PHP requirements, not a vendor statement. Synology's 22 Oct 2026 statement lists its vtigerCRM package among affected PHP-dependent packages.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "vultr", "company": "Vultr", "canonical_domain": "vultr.com", "group": "host", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://status.vultr.com/ (no PHP notice)", "https://blogs.vultr.com/ (posts of 21 and 22 Oct 2026 are not about PHP)", "https://www.vultr.com/news/ (newest item Feb 2026)", "https://www.vultr.com/ (no banner)", "search:Vultr PHP2Shell (search budget exhausted, not run)", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Nothing found on the status page, blog, news page or homepage.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "webflow", "company": "Webflow", "canonical_domain": "webflow.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://trust.webflow.com/", "statement_date": "undated (fetched 2026-10-23T00:38Z)", "status": "not affected", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://trust.webflow.com/", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:38:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Webflow's core services are not built on PHP and are not affected.", "notes": "\"Webflow's core services are not built on PHP and are not affected.\" \"Our security team is assessing non-production related systems that use PHP.\" \"No action is required from customers.\" quoted from https://trust.webflow.com/ (item: PHP2SHELL vulnerabilities statement, under Supply Chain Vulnerability Announcements; undated).", "ai_answer_note": null, "ai_answers": [] }, { "slug": "webrezpro", "company": "WebRezPro", "canonical_domain": "webrezpro.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:WebRezPro PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.webrezpro.com/ (homepage)", "https://webrezpro.com/security/ (System Security page, no PHP or CVE mention)", "https://webrezpro.com/blog/ (newest post October 20, 2026)", "https://webrezpro.com/blog/meeting-and-event-trends-for-independent-hotels/ (post published October 20, 2026, no PHP or security patch mention)", "https://webrezpro.com/press-releases/ (no items rendered to the reader)", "https://status.webrezpro.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page linked from the site. Newest blog post (October 20, 2026) is a hotel marketing article.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "whmcs", "company": "WHMCS", "canonical_domain": "whmcs.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://blog.whmcs.com/ (newest posts WHMCS 9.1 and maintenance releases, no dates printed, nothing on PHP2Shell)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (WHMCS self-hosted application listed Vulnerable citing system requirements only)", "search:WHMCS PHP2Shell (web search budget exhausted in this run)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No WHMCS statement on PHP2Shell found on its blog as of the last check. NCSC-NL inventory lists the WHMCS self-hosted application as Vulnerable on the basis of its PHP system requirements, not a vendor statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "woocommerce-automattic", "company": "WooCommerce, Automattic", "canonical_domain": "woocommerce.com", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://developer.woocommerce.com/2026/10/21/php-security-release/", "statement_date": "Oct 21, 2026", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://developer.woocommerce.com/blog/", "https://developer.woocommerce.com/2026/10/21/php-security-release/", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (WooCommerce listed Investigation", "WordPress.com plugin-enabled PHP hosting environment listed Investigation)" ], "last_checked_utc": "2026-10-23T00:45:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Post \"Critical Security Releases for PHP\" (Advisories). Mixed: Automattic's own platforms WordPress.com, WordPress VIP, Pressable and WP Cloud are described as already protected; everyone else must update PHP themselves. \"Due to the critical severity of the issues, store owners are encouraged to immediately update their installations of PHP.\" and \"No WooCommerce or WordPress update is required or planned for these issues.\" quoted from https://developer.woocommerce.com/2026/10/21/php-security-release/. PHP before 8.2 no longer receives security updates; WooCommerce recommends PHP 8.3 or newer; self-managed servers on older PHP advised to consider going offline while upgrading. No CVE IDs and no fixed PHP versions named.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is WooCommerce affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "As of October 23, 2026: WooCommerce’s specific status is still “under investigation”—not confirmed unaffected, and not confirmed patched. PHP itself has released fixes. Is WooCommerce affected? The Dutch National Cyber Security Centre’s (NCSC-NL) tracker lists WooCommerce as “Investigation” for both CVE-2026-109618 and CVE-2026-109619, stating: “PHP relationship confirmed; CVE match unknown.” This is not confirmation that every WooCommerce installation is", "cited_urls": [ "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_w.md", "https://www.php.net/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is WooCommerce affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive answer about WooCommerce and PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Is WooCommerce Affected by PHP2Shell? What is PHP2Shell? The PHP development team released emergency security updates to fix PHP2Shell — two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. CVE-2026-109618: RCE via out-of-memory corruption — when memory", "cited_urls": [ "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.czargroup.net/blog/php2shell-cve-2026-109618-cve-2026-109619-for-magento-2-adobe-commerce-and-woocommerce/", "https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://github.com/Anton-Barinov/php2shell-patches" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is WooCommerce affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. WooCommerce is affected when it runs on a vulnerable PHP runtime, because PHP2Shell is a flaw in the PHP engine—not in WooCommerce itself. Stores running PHP versions dating back to 5.4 may be exposed, regardless of whether WooCommerce’s own code is clean. WooCommerce has not been “patched” as a plugin; the required fix is to patch PHP. PHP", "cited_urls": [ "https://sansec.io/research/php2shell", "https://www.hostinger.com/blog/protecting-php2shell/", "https://www.eviant.com.au/resources/php2shell-php-rce-cve-2026-109618-australian-businesses/", "https://smarthost.ie/php-security-alert-21-10-26/amp/", "https://connection-technologies.co.uk/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://hamzaahmadaslam.com/blog/php-critical-security-update-php2shell", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/", "https://aiidelist.com/blog/php2shell-critical-php-rce-vulnerabilities-wordpress", "https://www.iovista.com/blog/php2shell-vulnerabilities-cve-2026-109618-109619/", "https://github.com/NCSC-NL/php2shell" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is WooCommerce affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "WooCommerce is not specifically affected, because the CVE-2026-109618 and CVE-2026-109619 (\"PHP2Shell\") vulnerabilities are flaws in the PHP runtime core itself, not in WooCommerce or WordPress code. Patch Status: No WooCommerce or WordPress code patch is required or planned. Instead, the underlying PHP runtime needs to be updated by your server or hosting provider to patched PHP versions (8.5.12, 8.4.27,", "cited_urls": [ "https://x.com/TheHackersNews/status/2112772879997861994", "https://developer.woocommerce.com/2026/10/21/php-security-release/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is WooCommerce affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: WooCommerce itself is not a vulnerable component, but any server running WooCommerce on top of a vulnerable PHP core language runtime version is indirectly affected. The flaws (CVE-2026-109618 and CVE-2026-109619, known as \"PHP2Shell\") reside within PHP's core memory/request handling rather than WooCommerce application code. Because WooCommerce requires PHP to run, any underlying environment utilizing an unpatched PHP", "cited_urls": [ "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "wordpress-wordpress-org", "company": "WordPress (WordPress.org)", "canonical_domain": "wordpress.org", "group": "platform", "index_category": null, "statement_found": true, "statement_url": "https://wordpress.org/news/2026/10/critical-php-security-release/", "statement_date": "October 21, 2026", "status": "customer must update", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "official page", "places_checked": [ "https://wordpress.org/news/", "https://wordpress.org/news/2026/10/critical-php-security-release/", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (WordPress.com hosting environment and WordPress Docker Official Image listed Investigation)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "News post \"Critical PHP Security Release\" by John Blackbourn (WordPress security team): \"Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP.\" , \"No WordPress update is required or planned for these issues.\" and \"Versions of PHP prior to 8.2 no longer receive security updates from the PHP project.\" quoted from the statement URL. Site owners told to check with their host, which may already be patching PHP or deploying WAF rules; self-managed sites on older PHP advised to consider taking the server offline while upgrading. No CVE IDs, no PHP versions, no WordPress.org infrastructure statement. Automattic's own hosting statement is in the WooCommerce row.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "wordpress-vip", "company": "WordPress VIP", "canonical_domain": "wpvip.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/", "statement_date": "October 21, 2026", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/", "https://wordpress.com/blog/2026/10/21/php2shell-vulnerabilities/", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Statement is by parent company Automattic, which operates WordPress VIP: \"If your site is hosted on WordPress.com, WordPress VIP, WP Cloud, Pressable, or Tumblr, your site is already protected.\" and \"There is nothing you need to do.\" quoted from https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/ (author Rudy). Says protected; does not describe the fix applied to VIP and names no deployed build (the fixed PHP releases 8.5.12, 8.4.27, 8.3.36, 8.2.35 are listed as PHP's releases). PENDING: check wpvip.com own blog/security page.", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress VIP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "WordPress VIP is already protected, according to Automattic—but its public notice does not explicitly confirm the deployed PHP patch versions. As of October 23, 2026, the official statement is that VIP-hosted sites are protected against both CVE-2026-109618 and CVE-2026-109619, with no customer action required. Automattic’s October 21, 2026 announcement states: > “If your site is hosted on WordPress.com, WordPress", "cited_urls": [ "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress VIP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive answer based on the latest sources: PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — WordPress VIP Status What is PHP2Shell? PHP2Shell is the name for two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. They are two CRITICAL-severity PHP core vulnerabilities that turn unauthenticated requests into remote code execution and Heartbleed-style memory", "cited_urls": [ "https://escape.tech/blog/php2shell-cve-2026-109618-cve-2026-109619-unauthenticated-rce-in-php-core-now-detected-by-escape/", "https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://www.elevationweb.org/blog/critical-php-flaw-what-it-meant-for-your-site/", "https://www.activeset.co/blog/php2shell-wordpress-what-to-check" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress VIP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "WordPress VIP was potentially affected at the PHP-runtime level, but Automattic says it was protected before or when the vulnerabilities were publicly disclosed. Automattic explicitly lists WordPress VIP among its platforms whose sites were already protected against PHP2Shell as of October 21, 2026. The vulnerabilities are in PHP itself, not WordPress core, themes, or plugins. PHP fixed them in", "cited_urls": [ "https://www.zarla.com/guides/php2shell", "https://automattic.com/2026/10/21/php2shell/", "https://tjrobertson.com/php-security-update-wordpress/", "https://wppoland.com/en/php2shell-wordpress-what-to-do/", "https://www.brillmark.com/php2shell-php-vulnerability-patch/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://wpsecurityninja.com/warnings/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress VIP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact: Yes, sites hosted on WordPress VIP use the PHP runtime and are technically exposed to the underlying PHP2Shell vulnerabilities (CVE-2026-109618 and ). Patch Status: Yes, WordPress VIP (along with related Automattic infrastructure like WordPress.com, WP Cloud, and Pressable) is already protected, and no action is required from site owners. Source: Official statements published by Automattic on Automattic News", "cited_urls": [ "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/", "https://www.facebook.com/AutomatticInc/posts/your-sites-are-protectedtoday-the-php-project-released-security-updates-for-two-/1590848439750954/", "https://customerhub.wpvip.com/lobby/2026/10/20/upcoming-php-security-release-no-action-required/", "https://x.com/wordpressdotcom/status/2113300432864882716" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress VIP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact Status: Yes, WordPress VIP infrastructure relies on PHP—the underlying runtime affected by the critical PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). However, sites hosted on the platform were shielded immediately. Patch/Mitigation Status: Yes, the platform is fully protected. Automattic applied early platform-level mitigations and rolled out official PHP updates across the network as soon as the PHP", "cited_urls": [ "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/", "https://dev.to/cseeman/patch-your-php-what-php2shell-means-for-wordpress-sites-2akn", "https://wordpress.com/blog/2026/10/21/php2shell-vulnerabilities/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "wordpress-com", "company": "WordPress.com", "canonical_domain": "wordpress.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://wordpress.com/blog/2026/10/21/php2shell-vulnerabilities/", "statement_date": "October 21, 2026", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://wordpress.com/blog/2026/10/21/php2shell-vulnerabilities/", "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:20:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "Your sites are already protected against the recently disclosed PHP security issues.", "notes": "\"Your sites are already protected against the recently disclosed PHP security issues.\" and \"On WordPress.com, PHP is installed, maintained, and patched by us at the infrastructure level, not by you.\" quoted from https://wordpress.com/blog/2026/10/21/php2shell-vulnerabilities/ (author Ian Stewart). Statement says protected, names no fixed build; status recorded as patched on the company's own words that PHP is patched by it and nothing is needed from customers. Parent post https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/ (October 21, 2026) lists PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 as the fixed releases and says \"If you are on PHP 8.1 or older, plan to move now.\" (that advice is for self-managed servers).", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress.com affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "WordPress.com says all hosted sites are protected against PHP2Shell, and customers need take no action. Its announcement was published on October 21, 2026. Automattic’s corresponding advisory explicitly identifies CVE-2026-109618 and CVE-2026-109619. There is an important distinction about “has it patched?”: WordPress.com says it manages PHP patching at the infrastructure level and that every site is covered. However, these announcements", "cited_urls": [ "https://wordpress.com/blog/2026/10/21/php2shell-vulnerabilities/" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress.com affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on the search results, I can provide a detailed answer. However, I must note an important caveat upfront: none of the search results contain any specific statement from Automattic/WordPress.com confirming or denying whether WordPress.com (the managed hosting platform) has patched PHP2Shell on its infrastructure. Here is what is known: PHP2Shell (CVE-2026-109618 & CVE-2026-109619): WordPress & WordPress.com What is", "cited_urls": [ "https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://meowapps.com/php2shell-wordpress/", "https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://github.com/Anton-Barinov/php2shell-patches", "https://www.brillmark.com/php2shell-php-vulnerability-patch/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress.com affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—WordPress.com was potentially within the affected ecosystem because PHP2Shell is a vulnerability in PHP itself, not WordPress, but Automattic states that sites hosted on WordPress.com were protected as soon as possible. Its notice explicitly says: “If your site is hosted on WordPress.com … your site is already protected.” Automattic says it worked with the PHP Security team to protect", "cited_urls": [ "https://meowapps.com/php2shell-wordpress/", "https://wppoland.com/en/php2shell-wordpress-what-to-do/", "https://www.zarla.com/guides/php2shell", "https://automattic.com/2026/10/21/php2shell/", "https://www.brillmark.com/php2shell-php-vulnerability-patch/", "https://stackharbor.com/en/blog/php2shell-cve-2026-109618-109619-what-we-know/", "https://www.moweb.com/blog/php2shell-cve-2026-109618-cve-2026-109619-php-rce-patch-guide", "https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html?m=1&hl=en_US", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://hamzaahmadaslam.com/blog/php-critical-security-update-php2shell" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress.com affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, sites hosted on WordPress.com are protected against the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and Automattic has already ensured those services are secured. Source and Details Source: The Repository and reporting on Automattic's official blog statements. Status: Automattic's Artistic Director and Product Lead Ian Stewart stated that WordPress.com, WordPress VIP, WP Cloud, and Pressable were already protected against PHP2Shell", "cited_urls": [ "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "https://www.northjersey.com/story/news/2026/10/22/php-vulnerability-2026-affected-websites-security-risk/92379378007/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers", "https://dev.to/cseeman/patch-your-php-what-php2shell-means-for-wordpress-sites-2akn" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress.com affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: WordPress.com (hosted directly by Automattic) and Tumblr were exposed to the underlying PHP runtime risks of the \"PHP2Shell\" flaws (CVE-2026-109618 and CVE-2026-109619), but Automattic confirmed that hosted infrastructure was secured. Patch Status: Yes, it has been patched. Automattic explicitly stated that websites hosted directly on WordPress.com are safe and protected following the emergency PHP core updates. (Note:", "cited_urls": [ "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/", "https://timesofindia.indiatimes.com/technology/tech-news/php2shell-governments-on-high-alert-over-critical-website-flaw-wikipedia-hospitals-school-portals-go-dark-what-users-should-know/articleshow/135110798.cms", "https://meowapps.com/php2shell-wordpress/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "workiz", "company": "Workiz", "canonical_domain": "workiz.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.workiz.com/", "https://www.workiz.com/trust-center/", "https://www.workiz.com/press/", "https://www.workiz.com/blog/" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. Trust Center has no dated notices and no PHP mention; press newest item July 9, 2025; blog listing undated; no status page link.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "workwave", "company": "WorkWave", "canonical_domain": "workwave.com", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:WorkWave PHP2Shell", "https://www.workwave.com/ (homepage)", "https://www.workwave.com/security (general security overview, no CVE or PHP mention)", "https://www.workwave.com/newsroom (newest item Oct 20, 2026)", "https://www.workwave.com/newsroom/workwave-announces-two-new-ai-driven-analytics-decision-support-for-pestpac-and-realgreen-that-reduce-customer-churn-and-increase-services-per-tech (press release dated Oct. 20, 2026, no PHP or security patch mention)", "https://www.workwave.com/blog (newest post February 25, 2026)", "https://status.workwave.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Newest newsroom item (Oct. 20, 2026) is a product announcement with no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "wp-cloud", "company": "WP Cloud", "canonical_domain": "wp.cloud", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://wp.cloud/wp-cloud-powered-sites-protected-against-critical-php-vulnerabilities/", "statement_date": "Oct 21, 2026", "status": "patched", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "official page", "places_checked": [ "https://wp.cloud/blog/", "https://wp.cloud/wp-cloud-powered-sites-protected-against-critical-php-vulnerabilities/ (read from the blog index excerpt)", "https://wp.cloud/", "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T01:33:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "WP Cloud-powered sites are already protected against both vulnerabilities.", "notes": "\"WP Cloud-powered sites are already protected against both vulnerabilities.\" quoted from https://wp.cloud/wp-cloud-powered-sites-protected-against-critical-php-vulnerabilities/ (title: WP Cloud-Powered Sites Protected Against Critical PHP Vulnerabilities; Oct 21, 2026; excerpt also says Automattic worked closely with the PHP Security team). Says protected; names no deployed build. Parent Automattic post of October 21, 2026 also names WP Cloud: \"There is nothing you need to do.\" WP Cloud is \"An Automattic venture\" per its footer.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "wp-engine", "company": "WP Engine", "canonical_domain": "wpengine.com", "group": "host", "index_category": null, "statement_found": true, "statement_url": "https://wpenginestatus.com/incidents/969801", "statement_date": "10/21/2026 08:19:42PM CDT (CLOSED, Resolved; created 10/21/2026 08:40:00AM CDT)", "status": "patched", "fixed_version_named": "yes: PHP 7.4.33.17, 8.2.35, 8.4.27, 8.5.12", "workers_restart_stated": "no", "eol_plan_stated": "yes", "source_type": "status page", "places_checked": [ "https://wpenginestatus.com/incidents/969801 (needs JavaScript", "read in a browser after plain fetch returned only the loading shell)", "https://wpenginestatus.com/rss (loading shell only)", "https://wpengine.com/blog/ (no post)", "search:WP Engine PHP2Shell", "search:site:wpengine.com PHP security vulnerability CVE-2026-109618", "https://www.activeset.co/blog/php2shell-host-status", "https://topsitehosters.com/blog/php2shell-web-hosts-patch-status/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers" ], "last_checked_utc": "2026-10-23T00:31:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": "WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on our platform. The patches have been applied to your PHP version, and no action is needed from you.", "notes": "\"WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on our platform. The patches have been applied to your PHP version, and no action is needed from you.\" quoted from https://wpenginestatus.com/incidents/969801 (incident: PHP Security Update; wpenginestatus.com is WP Engine's status page). Updated PHP versions listed: 7.4.33.17, 8.2.35, 8.4.27, 8.5.12 (all versions running on the platform, including 7.4). Earlier updates: protective mitigations at the CDN layer via Cloudflare and Fastly and at the hosting layer (10/21/2026 08:40:00AM CDT and 12:30:00PM CDT).", "ai_answer_note": null, "ai_answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WP Engine affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "WP Engine treated PHP2Shell as applicable to its platform and has since reported all customer sites patched. As of October 23, 2026, the available updates show: Initial response, October 21: WP Engine’s official status notice said it was rolling out PHP patches across customer platforms and had already deployed Cloudflare/Fastly CDN mitigations. This was a patching-in-progress notice—not a claim", "cited_urls": [ "https://wpenginestatus.com/incidents/969801?utm_source=openai", "https://www.reddit.com/r/wpengine/comments/1xcv4kq/php_vulnerability_update/?utm_source=openai" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WP Engine affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on the search results, here is what is known about WP Engine and PHP2Shell (CVE-2026-109618 & CVE-2026-109619): PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — WP Engine Status What is PHP2Shell? PHP2Shell refers to two critical PHP vulnerabilities that could lead to unauthenticated remote code execution. Patches are available for supported PHP 8.x branches, and exploitation attempts began before public disclosure.", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://iceboxdesigns.co.uk/blog/php2shell-wordpress-php-vulnerability-cve-2026-109618/", "https://meowapps.com/php2shell-wordpress/" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WP Engine affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—WP Engine was affected, because PHP2Shell is a vulnerability in the PHP runtime, not WordPress itself. WP Engine reportedly ran vulnerable PHP branches and was still rolling out fixes as of October 22, 2026, with mitigations in place during deployment. The available source says WP Engine planned to update all PHP versions it operates—7.4, 8.2, 8.4, and 8.5—but does", "cited_urls": [ "https://meowapps.com/php2shell-wordpress/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://netenrich.com/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://github.com/NCSC-NL/php2shell", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.zarla.com/guides/php2shell", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "https://github.com/0xDTC/0xPHP2SHELL-Impact-Analysis", "https://github.com/0xDTC/0xPHP2SHELL-Impact-Analysis/blob/master/Readme.md" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WP Engine affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, WP Engine was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the platform has applied patches across its servers. Impact: WP Engine hosts WordPress sites that rely on the underlying PHP runtime, which was vulnerable to unauthenticated remote code execution flaws rated 9.2 CVSS v4.0. Mitigations & Patching: WP Engine implemented initial network and CDN-layer mitigations (via", "cited_urls": [ "https://dev.to/cseeman/patch-your-php-what-php2shell-means-for-wordpress-sites-2akn", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://www.reddit.com/r/Wordpress/comments/1xc0w1d/if_your_wordpress_site_is_on_php_81_or_older_the/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WP Engine affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: Yes, WP Engine's servers and hosting environments run PHP, meaning the platform was technically exposed to the underlying critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) before updates were finalized. Patch Status: Yes, WP Engine has addressed the issue. According to customer communications and developer reports, WP Engine implemented network and server-level mitigations even before PHP officially released its", "cited_urls": [ "https://dev.to/cseeman/patch-your-php-what-php2shell-means-for-wordpress-sites-2akn", "https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "wrike", "company": "Wrike", "canonical_domain": "wrike.com", "group": "index_vendor", "index_category": "project_management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Wrike PHP2Shell", "https://www.wrike.com/security/ (security page, no PHP or CVE mention)", "https://security.wrike.com/ (Wrike Trust Center, no dated updates or PHP mention in the fetch)", "https://status.wrike.com/ (status page, no incident text in the fetch)" ], "last_checked_utc": "2026-10-23T02:17:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No PHP2Shell item on the security page or trust center; the status page did not render incident text.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "xenforo", "company": "XenForo", "canonical_domain": "xenforo.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://xenforo.com/community/forums/announcements.3/ (newest announcement 9 Oct 2026, nothing on PHP2Shell)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (XenForo listed Vulnerable citing developer docs only)", "search:XenForo PHP2Shell (web search budget exhausted in this run)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No XenForo Ltd statement on PHP2Shell found in its announcements forum as of the last check. NCSC-NL inventory lists XenForo as Vulnerable on the basis of its PHP requirements, not a vendor statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "xldent", "company": "XLDent", "canonical_domain": "xldent.com", "group": "index_vendor", "index_category": "dental-practice-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.xldent.com/", "https://www.xldent.com/blog", "https://www.xldent.com/blog/three-answers-to-the-same-phone-call/", "https://www.xldent.com/support (fetch failed, client error)", "https://www.xldent.com/about (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T01:23:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust or status link in site navigation; blog newest post October 16, 2026 (support-call handling) has no PHP mention.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "yanolja-cloud-solution-ezee", "company": "Yanolja Cloud Solution (eZee)", "canonical_domain": "yanoljacloudsolution.com", "group": "index_vendor", "index_category": "hotel-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Yanolja Cloud Solution eZee PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.yanoljacloudsolution.com/ (homepage)", "https://yanoljacloudsolution.com/security-and-compliance (security and compliance page, no PHP mention)", "https://yanoljacloudsolution.com/blog (newest post October 9, 2026)", "https://yanoljacloudsolution.com/product-updates (newest item July 2026)", "https://status.yanoljacloudsolution.com/ (fetch failed, robots disallowed)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No status page linked from the site.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "yardi", "company": "Yardi", "canonical_domain": "yardi.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Yardi PHP2Shell", "https://www.yardi.com/ (homepage, no security, trust or status link in header or footer, no notice)", "https://www.yardi.com/news/press-releases/ (newest release October 21, 2026, a Yardi Matrix self storage report, none on PHP)" ], "last_checked_utc": "2026-10-23T02:10:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No security, trust or status page is linked from yardi.com. Newest press release (October 21, 2026) is a market report.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "zabbix", "company": "Zabbix", "canonical_domain": "zabbix.com", "group": "platform", "index_category": null, "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.zabbix.com/security_advisories (list loads dynamically)", "https://assets.zabbix.com/files/zabbix_security_advisories.rss (newest ZBV-2026-10-05-1 to -6, 5 Oct 2026, nothing on PHP)", "https://blog.zabbix.com/ (newest 14 Oct 2026)", "https://www.zabbix.com/forum/zabbix-announcements (only \"Zabbix 8.0.0rc2 version is out now!\" visible, nothing on PHP2Shell)", "https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Zabbix web frontend listed Vulnerable citing frontend requirements only)" ], "last_checked_utc": "2026-10-23T01:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Zabbix statement on PHP2Shell found in the security advisory feed, blog or announcements forum as of the last check. NCSC-NL inventory lists the Zabbix web frontend as Vulnerable on the basis of PHP requirements, not a vendor statement.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "ziidms", "company": "ZiiDMS", "canonical_domain": "ziidms.com", "group": "index_vendor", "index_category": "dealership-management-systems", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "https://www.ziidms.com/", "https://www.ziidms.com/support/", "https://www.ziidms.com/blog (fetch failed, client error)", "https://www.ziidms.com/events/" ], "last_checked_utc": "2026-10-23T01:08:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "WebSearch not run for this company (per-turn search quota exhausted); direct page reads only. No security, trust, status, blog or news link in site navigation; support and events pages have no security notice.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "zillow-rental-manager", "company": "Zillow Rental Manager", "canonical_domain": "zillow.com", "group": "index_vendor", "index_category": "residential-property-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Zillow PHP2Shell", "https://www.zillow.com/rental-manager/ (Rental Manager page, no security, trust or status link, no notice)", "https://zillow.mediaroom.com/ (newsroom, newest release Oct 22, 2026 on homeownership costs, none on PHP)" ], "last_checked_utc": "2026-10-23T02:12:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No PHP2Shell item in the Zillow newsroom; newest release (Oct 22, 2026) concerns homeownership costs.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "zoho-crm", "company": "Zoho CRM", "canonical_domain": "zoho.com", "group": "index_vendor", "index_category": "crm", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Zoho PHP2Shell", "https://www.zoho.com/security.html (security page, \"Last updated on: 4th December 2024\", no PHP or CVE mention)", "https://status.zoho.com/ (302 redirect to https://us.zohostatus.com/, no dated incidents, no PHP mention)", "https://us.zohostatus.com/rss (status feed, latest items 15 and 16 Oct 2026, no PHP mention)", "https://pitstop.manageengine.com/portal/en/community/topic/security-alert-two-critical-php-rce-vulnerabilities-php2shell-rated-cvss-9-2-21-10-2026 (ManageEngine community post)", "https://www.manageengine.com/blog/general/update-on-php-vulnerabilities-cve2026109618-and-cve2026109619.html (fetch failed, client error)" ], "last_checked_utc": "2026-10-23T02:17:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No Zoho statement on zoho.com or the Zoho status pages. ManageEngine (a Zoho Corporation division) community post \"Linux Security Alert: Two Critical PHP RCE Vulnerabilities (PHP2Shell) Rated CVSS 9.2\" tells Vulnerability Manager Plus customers how to deploy PHP patches on their own Linux systems; it does not mention Zoho or Zoho CRM. The ManageEngine blog update could not be fetched in this check.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "zuper", "company": "Zuper", "canonical_domain": "zuper.co", "group": "index_vendor", "index_category": "field-service-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Zuper PHP2Shell", "https://www.zuper.co/ (homepage)", "https://trust.zuper.co/ (fetch failed, client error)", "https://www.zuper.co/security (fetch failed, client error)", "https://zuperpro.statuspage.io/ (status page, inactive for public)", "https://www.zuper.co/blog (posts undated, none on PHP)", "https://www.zuper.co/newsroom (newest item Sep 10, 2026)" ], "last_checked_utc": "2026-10-23T00:22:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "Status page reads \"This page is currently inactive and can only be viewed by team members.\" quoted from https://zuperpro.statuspage.io/. Trust center did not load.", "ai_answer_note": null, "ai_answers": [] }, { "slug": "zywave", "company": "Zywave", "canonical_domain": "zywave.com", "group": "index_vendor", "index_category": "insurance-agency-management", "statement_found": false, "statement_url": null, "statement_date": null, "status": "no public statement located", "fixed_version_named": "no", "workers_restart_stated": "no", "eol_plan_stated": "no", "source_type": "none", "places_checked": [ "search:Zywave PHP2Shell (not performed, WebSearch budget exhausted)", "https://www.zywave.com/ (homepage)", "https://www.zywave.com/hipaa-security/ (HIPAA security incident reporting page, no PHP or CVE mention)", "https://www.zywave.com/blogs/ (posts undated, none on PHP)", "https://www.zywave.com/newsroom/ (newest item Oct 20, 2026, Zywave Apex AI updates, no PHP mention in listing)", "https://www.zywave.com/blog/zywave-apex-ai-updates-deliver-sharper-prospecting-and-commercial-loss-data-in-leading-ai-tools/ (newest newsroom item, October 20, 2026, no PHP mention", "rechecked 2026-10-23T02:22Z)" ], "last_checked_utc": "2026-10-23T01:25:00Z", "change_log": [ { "date": "2026-10-23", "note": "first check" } ], "excerpt": null, "notes": "No dedicated security, trust or status page linked from the site.", "ai_answer_note": null, "ai_answers": [] } ] }