PHP2Shell statement record · Platform
No public statement located as of 23 October 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
No public statement located as of at: https://developer.joomla.org/security-centre.html (newest [20260916], 16 Sep 2026); https://www.joomla.org/announcements.html (newest 13 Oct 2026, Joomla 6.2); https://www.joomla.org/announcements/general-news.html (newest dated 5 Feb 2024); https://magazine.joomla.org/ (no PHP2Shell content); https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (Joomla 6.x listed Vulnerable citing technical requirements only).
No Joomla statement on PHP2Shell found in the Security Centre, announcements, general news or magazine as of the last check. NCSC-NL inventory lists Joomla 6.x as Vulnerable on the basis of PHP requirements, not a project statement. Synology's 22 Oct 2026 statement lists its Joomla package among affected PHP-dependent packages.
no status named
Yes—Joomla is affected when it runs on a vulnerable PHP runtime. A fix is available, but it is a PHP update, not a Joomla CMS patch. As of October 23, 2026, NCSC-NL lists Joomla 6.x as “Vulnerable” for both CVE-2026-109618 and CVE-2026-109619, explicitly identifying a PHP runtime upgrade as the remediation. Confirmed impact: The discovering researchers demonstrated unauthenticated remote
no status named
Great — here is a comprehensive answer based on multiple reputable sources: Is Joomla Affected by PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? ✅ Yes — Joomla Is Affected The bugs allow unauthenticated remote code execution and Heartbleed-style memory disclosure in PHP itself, independent of the application running on top of it. This is the critical point: the vulnerabilities are not in
differs
Yes. Joomla sites are affected when they run a vulnerable PHP version, because PHP2Shell is a flaw in the PHP runtime—not in Joomla’s own code. Researchers demonstrated unauthenticated remote code execution against a Joomla container image. Joomla has not “patched” this in a Joomla release. Updating Joomla alone does not remediate the issue; the underlying PHP installation must be
no status named
Yes, Joomla deployments can be exposed to PHP2Shell (CVE-2026-109618 and CVE-2026-109619) because the critical remote code execution flaws reside in the PHP core engine runtime itself, rather than in Joomla's application code. How to Fix / Mitigation Joomla Patch Status: Because the vulnerabilities exist in the underlying PHP language interpreter, fixing the issue requires updating the PHP runtime on
no status named
Is Joomla affected? Yes. The "PHP2Shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are core remote code execution (RCE) and memory-disclosure flaws residing within the underlying PHP engine itself, rather than application-specific code. Security researchers have demonstrated that unauthenticated RCE and memory disclosure via these PHP flaws affect applications running on vulnerable PHP runtimes, including Joomla, WordPress, and Drupal. Has it patched?
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
A badge is issued once a public statement is located and verified on the company's own domain or verified official account.
Joomla's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Joomla and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy