MediaWiki, Wikimedia and PHP2Shell

The statement

No public statement located as of 23 October 2026, 01:22 UTC at: https://www.mediawiki.org/wiki/News (fetch failed, url_not_found); https://www.mediawiki.org/wiki/MediaWiki (fetch failed); https://www.mediawiki.org/w/index.php?search=PHP2Shell+OR+CVE-2026-109618&title=Special%3ASearch (fetch failed); https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/ (fetch failed); https://techblog.wikimedia.org/ (fetch failed); https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (MediaWiki listed Vulnerable citing installation requirements; Wikimedia application-server PHP tier listed Investigation).

Notes

No MediaWiki or Wikimedia Foundation statement could be located: every mediawiki.org and wikimedia.org page tried in this run failed to load, so this row is unverified rather than confirmed absent. NCSC-NL inventory lists MediaWiki as Vulnerable on the basis of PHP requirements, not a project statement. Synology's 22 Oct 2026 statement lists its MediaWiki package among affected PHP-dependent packages.

Change log

• 23 October 2026: first check

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

A badge is issued once a public statement is located and verified on the company's own domain or verified official account.

MediaWiki, Wikimedia's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about MediaWiki, Wikimedia and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.