PHP2Shell statement record · Host
Status in the company's own words: patched. Statement dated Resolved Oct 22, 2026 - 06:10 EDT (Identified Oct 21, 2026 - 11:31 EDT); newsroom article listed October 22, 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on www.ionos-status.com, dated Resolved Oct 22, 2026 - 06:10 EDT (Identified Oct 21, 2026 - 11:31 EDT); newsroom article listed October 22, 2026. Source type: status page.Websites and hosting at IONOS are protected.
Websites and hosting at IONOS are protected.
(Resolved, Oct 22, 2026 - 06:10 EDT) quoted from https://www.ionos-status.com/incidents/3fkdbfd8zldr (title: Security maintenance: Short interruptions possible on PHP-based services; ionos-status.com is linked from ionos.com as Status Page). Newsroom article https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/ (listed October 22, 2026; article body undated): IONOS has already applied the official security update on all platforms it operates itself
; covers Web Hosting, Managed WordPress, MyWebsite 8, Managed Nextcloud, HiDrive Next; customized PHP configurations and firewall rules were added before the release. Mixed: VPS, Bare Metal and other self-managed customers must install the PHP update themselves. No fixed version, restart or EOL statement.
match
Yes—IONOS’s PHP-based services were in scope, and IONOS confirms it has patched all platforms it operates itself. Self-managed servers are the exception. As of October 23, 2026: IONOS-operated hosting: patched. IONOS names Web Hosting, Managed WordPress, MyWebsite 8, Managed Nextcloud, and HiDrive Next, and says customers on its operated platforms need not take action. Its official statement says: “IONOS
contradiction
I was unable to find any specific statement, advisory, or blog post from IONOS (the web hosting and cloud provider) addressing PHP2Shell (CVE-2026-109618 and CVE-2026-109619) — either confirming they are affected or announcing a patch. It is important to note that the IONIX result that appeared in searches refers to IONIX (a cybersecurity attack surface management company), which is
match
There is no public evidence in the available sources confirming that IONOS itself was affected or that IONOS has patched its managed hosting infrastructure. What can be established: PHP2Shell affects vulnerable PHP installations serving web requests. PHP released fixes in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on October 21, 2026. Older PHP 7.4–8.1 branches received only source-level backports, while
differs
IONOS is technically affected because the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) impact the core PHP engine across all hosting environments running unpatched PHP, though official public confirmation or status updates directly from IONOS regarding whether they have completed patching remain limited or unspecified in their documentation as of October 22, 2026 . What is Affected The Vulnerability: PHP2Shell consists
differs
As an infrastructure and hosting provider that supports various PHP versions across its shared hosting, VPS, and cloud platforms, IONOS utilizes PHP configurations that are fundamentally subject to the core PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). These critical remote code execution (RCE) flaws affect unpatched versions of PHP globally. However, public official statements or dedicated advisory trackers
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for IONOS reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
IONOS's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about IONOS and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy