Status in the company's own words: customer must update. Statement dated October 21, 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Post Critical PHP security release today - please get your Mautic servers ready names CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2). Self-hosted admins must update PHP themselves, then restart PHP-FPM or the web server and anything else running PHP such as queue workers; managed instances to ask their host or partner. The PHP team is clear that none of them make a server safe, and only updating fixes the problem quoted from the statement URL (on the interim settings). Updated Docker images for Mautic 5, 6 and 7 released; Mautic Trials signup removed while that infrastructure is patched. PHP 8.1 and older have no official fixed version; minimal backports for 7.4, 8.0, 8.1 noted; PHP 8.2 reaches end of life 31 Dec 2026.
Change log
: first check
What the five engines said
AI answers not yet measured
Submit a correction or your statement
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
Badge
The badge for Mautic reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Mautic's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Mautic and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
About this page
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.