F5 and PHP2Shell

The statement

No public statement located as of 23 October 2026, 01:22 UTC at: https://my.f5.com/manage/s/article/K000163821 (fetch failed: page requires JavaScript, only a CSS error loaded); https://cdn.f5.com/product/bugtracker/ID1270257.html (bug for CVE-2023-0662, no PHP2Shell content); https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (F5 BIG-IP TMOS and BIG-IP APM listed Investigation citing K000163821); fetch limit, retry next hour (F5 security advisory listing not yet checked).

Notes

The F5 article K000163821 that NCSC-NL cites could not be read in this run (JavaScript-only page), so no statement is confirmed here. Reported by NCSC-NL inventory (status update 23 Oct 2026): K000163821 lists BIG-IP (all modules) 21.x and 17.x under investigation for CVE-2026-109618 and CVE-2026-109619, confirmation of vulnerability not yet available. Unverified until the F5 page is read.

Change log

• 23 October 2026: first check

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

A badge is issued once a public statement is located and verified on the company's own domain or verified official account.

F5's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about F5 and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.