PHP2Shell statement record · Platform
Status in the company's own words: customer must update. Statement dated 2026-October-21 (published 2026-10-21T03:30:59+00:00, last modified 2026-10-21T16:08:15+00:00).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on www.drupal.org, dated 2026-October-21 (published 2026-10-21T03:30:59+00:00, last modified 2026-10-21T16:08:15+00:00). Source type: official page.
PSA-2026-10-20 Critical PHP update on Wednesday, October 21, 2026 (14:00 UTC)
: If you manage PHP yourself, you'll need to apply the update.
and Updating to a PHP release containing the patch to these vulnerabilities is the only complete mitigation.
quoted from https://www.drupal.org/psa-2026-10-20. Hosted sites told to follow their host's communications. No CVE IDs, no PHP versions, no Drupal core update discussed; Security Team remit limited to code hosted on Drupal.org.
differs
Yes—Drupal sites running vulnerable PHP are affected, and fixes are available in PHP, not as a Drupal-core patch. As of October 23, 2026: Affected: Researchers demonstrated unauthenticated remote code execution against Drupal. CVE-2026-109618 and CVE-2026-109619 are vulnerabilities in the underlying PHP runtime, rather than Drupal’s application code. Drupal’s response: Its official PSA-2026-10-20 directs administrators or hosting providers to update
differs
Yes, Drupal is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), but the fix comes from patching PHP itself, not Drupal. Here is a detailed breakdown: ⚠️ What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP. Both are rated CVSS v4.0 9.2. Both allow unauthenticated remote code execution on default configurations. The two
no status named
Yes. Drupal sites are affected when they run a vulnerable PHP runtime—the flaws are in PHP itself, not Drupal core. Researchers demonstrated unauthenticated remote-code execution against current Drupal images, and Drupal’s own statement says updating Drupal alone is insufficient. Has Drupal patched it? Not in Drupal core. The required fix is to update the underlying PHP installation to a
differs
Yes, Drupal sites are affected if they run on an unpatched PHP runtime, because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability in the PHP core engine itself rather than Drupal's application code. Key Details Affected Status: Any Drupal site running on a vulnerable version of PHP can be targeted for unauthenticated remote code execution (RCE) or memory disclosure. The
no status named
Yes, Drupal sites are affected by PHP2Shell, but because these vulnerabilities (CVE-2026-109618 and CVE-2026-109619) exist within the underlying PHP core engine itself rather than inside Drupal’s application code, Drupal cannot issue an internal software patch to fix them. Security researchers confirmed that unauthenticated remote code execution attacks via PHP2Shell are possible against servers running Drupal 11.4 (as well as
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Drupal reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Drupal's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Drupal and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy