PHP2Shell statement record · Host
Status in the company's own words: patching. Statement dated October 22, 2026 4:24AM PDT (latest, MONITORING; first October 21, 2026 6:46AM PDT).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on www.dreamhoststatus.com, dated October 22, 2026 4:24AM PDT (latest, MONITORING; first October 21, 2026 6:46AM PDT). Source type: status page.completed the deployment of the official PHP security fixes across a large portion of our hosting infrastructure
completed the deployment of the official PHP security fixes across a large portion of our hosting infrastructure
(October 21, 2026 10:59PM PDT) and we will send out a notification upon final rollout completion
(October 22, 2026 4:24AM PDT) quoted from https://www.dreamhoststatus.com/ (incident: PHP Security Vulnerability: Protections Are In Place; DreamHost's status site). Affected products listed: Web Hosting, Managed VPS Hosting, DreamPress Hosting, Dedicated Server Hosting. WAF blocking exploit attempts; no customer action required. PHP 8.1 and older: Security fixes for these versions, provided under our PHP Extended Support program, are being built
(October 21, 2026 1:43PM PDT).
differs
Yes—DreamHost treated its PHP hosting infrastructure as affected, and says patching is complete. As of October 23, 2026, its latest official update reports that PHP security updates have been deployed across its entire network. The incident covers shared hosting, Managed VPS, DreamPress, and dedicated hosting. DreamHost’s timeline: October 21: Protections were in place, followed by rollout of the official
contradiction
Based on my thorough search of available sources, I found extensive information about PHP2Shell (CVE-2026-109618 and CVE-2026-109619), but no public statement, advisory, blog post, or announcement from DreamHost specifically addressing these vulnerabilities has appeared in any search results. Here is a full breakdown of what is known: ⚠️ DreamHost — No Public Statement Found There is no publicly available
match
Yes—DreamHost was affected because its servers run PHP, and PHP2Shell affected all PHP installations serving web requests. DreamHost reportedly said it was rolling out PHP’s fix across all servers, while blocking known attack paths in the interim, as of October 21, 2026. The available report does not confirm that the rollout was fully completed; it says only that deployment
differs
DreamHost is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the provider is actively rolling out fixes across its network while deploying temporary firewall protections. Affected Status: DreamHost servers and shared hosting environments initially ran unpatched PHP runtimes. Patch Progress: DreamHost reported that the fixed PHP builds were rolling out to the bulk of its network, with final
match
Yes, DreamHost's hosting infrastructure was potentially exposed because the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affect the core PHP engine runtime itself rather than a specific web application. DreamHost's Status & Patching Mitigation & WAF Protection: DreamHost's Operations and Technical teams deployed immediate mitigations across all hosting platforms (Shared, VPS, DreamPress, and Dedicated). Their Web Application Firewall (WAF) was configured
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for DreamHost reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
DreamHost's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about DreamHost and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy