PHP2Shell statement record · Platform
Status in the company's own words: patching. Statement dated Thursday, 22 October 2026, 2:11 AM.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on moodle.org, dated Thursday, 22 October 2026, 2:11 AM. Source type: official page.
Post Update on Moodle's Response to the PHP2SHELL vulnerability for our public facing sites
by Amy Tessitore (Moodle HQ) on moodle.org: HQ took its public-facing sites offline as a precaution on 21 Oct 2026, has patched its own site and is deploying and validating patches on its other public-facing and client sites. Unpatched sites remain vulnerable to potential exploits related to PHP2SHELL.
quoted from https://moodle.org/mod/forum/discuss.php?d=482882. Self-hosted sites told to create a plan to update your PHP with the released security patches, immediately.
No CVE numbers, no PHP versions, no MoodleCloud mention.
differs
Yes—Moodle sites running vulnerable PHP are affected, and patches are available. The fix is to PHP, not simply an update to Moodle’s application code. Moodle explicitly warns that unpatched sites remain vulnerable. Patch status as of October 23, 2026: Moodle.org: Moodle HQ’s October 22 announcement confirms: “We have patched this site and brought it back online.” Other Moodle-managed sites:
differs
Based on the search results, here is a thorough answer about Moodle's relationship to PHP2Shell: Is Moodle Affected by PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? Yes — Because the Vulnerability Is in PHP Itself, Not the Application The critical point is that PHP2Shell does not target application-level code in platforms like Moodle. PHP2Shell refers to two CRITICAL-severity PHP core vulnerabilities (CVE-2026-109618,
differs
Yes. Moodle is affected indirectly because PHP2Shell vulnerabilities are in the PHP runtime, not in Moodle itself. Any Moodle site running an affected, web-facing PHP version is exposed; updating Moodle alone does not remediate it. PHP released fixes on October 21, 2026 in: PHP 8.2.35 PHP 8.3.36 PHP 8.4.27 PHP 8.5.12 Therefore, Moodle is patched only when the server’s
differs
Yes, Moodle is affected indirectly because it runs on PHP, and Moodle HQ has already applied security patches to its hosted infrastructure. Impact and Patch Status The Vulnerability: CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell") are critical RCE flaws located inside the core PHP engine rather than Moodle's own application code. Any platform running on an unexposed or unpatched PHP version is
no status named
Impact: Yes, Moodle platforms run on PHP and were affected by the PHP2SHELL vulnerabilities (CVE-2026-109618 and CVE-2026-109619). As a precautionary measure, Moodle HQ temporarily took their public-facing sites offline when the vulnerability details were made public. Patch Status: Patches and updates have been released and deployed by Moodle HQ for their managed infrastructure, and they are continuing validation across
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Moodle reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Moodle's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Moodle and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy