PHP2Shell statement record · Host
Status in the company's own words: patched. Statement dated Oct 22, 2026 - 08:26 UTC (Resolved; first update Oct 21, 2026 - 19:04 UTC).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on status.kinsta.com, dated Oct 22, 2026 - 08:26 UTC (Resolved; first update Oct 21, 2026 - 19:04 UTC). Source type: status page.All sites are protected, the PHP security updates have been rolled out across the platform
All sites are protected, the PHP security updates have been rolled out across the platform
quoted from https://status.kinsta.com/incidents/c0c6xl1ghpb2 (title: PHP Security Vulnerability Update). Patches rolled out for PHP 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 and 8.5; Cloudflare and local configuration mitigations stay in place for all sites until further notice. 19:04 UTC update: No action is required on your end.
(customers on 8.3/8.5 could switch PHP version and back to apply the patch immediately).
match
Kinsta has completed patching its platform. As of October 23, 2026, its official incident report marks the PHP security issue resolved, with rollout completed on October 22, 2026, at 08:26 UTC. Was it affected? Kinsta treated its PHP infrastructure as requiring patches; it did not claim the platform was inherently unaffected. During rollout, it reported that Cloudflare protections and
match
Yes, Kinsta was affected by PHP2Shell, and it has fully patched. Here is a detailed breakdown: What Is PHP2Shell? CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. CVE-2026-109618 stems from how PHP handles out-of-memory (OOM) errors. If memory runs out while PHP's
no status named
Yes. Kinsta was affected because PHP2Shell impacts the PHP runtime, including versions Kinsta offered, and Kinsta reported that it rolled out the security updates across its platform. Kinsta’s remediation was completed at 08:26 UTC on October 22, 2026, covering PHP branches 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, and 8.5. Its incident update said that all sites were protected and
no status named
Kinsta was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and all customer sites have been protected as Kinsta rolled out the necessary PHP security updates across its platform. Key Details & Status Impact: The vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affected PHP runtime environments utilized across hosted applications. Patch Status: Patched and rolled out across Kinsta's infrastructure. Kinsta confirmed that
no status named
Affected Status: Because Kinsta hosts WordPress and other PHP-based applications, servers running vulnerable versions of PHP (branches 8.2 through 8.5) were inherently exposed to the "PHP2Shell" remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) prior to mitigation. Major managed hosting providers like Kinsta received early notification/access or moved rapidly to prepare and deploy updates as emergency patches dropped. Patch Status:
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Kinsta reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Kinsta's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Kinsta and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy