PHP2Shell statement record · Host
Status in the company's own words: patching. Statement dated Oct 21, 2026 - 22:09 EDT (latest; first Oct 21, 2026 - 09:27 EDT).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on status.nexcess.com, dated Oct 21, 2026 - 22:09 EDT (latest; first Oct 21, 2026 - 09:27 EDT). Source type: status page.Our Engineering teams are actively working to deploy patched PHP builds across our hosting infrastructure.
Our Engineering teams are actively working to deploy patched PHP builds across our hosting infrastructure.
quoted from https://status.nexcess.com/incidents/n4fpf22f5xtf (title: PHP Security Vulnerability Assessment (CVE-2026-109618 & CVE-2026-109619)). No completion notice at this check; same wording as sister brand Liquid Web. Customers told to verify patch status and, if unpatched, run a package update through their control panel; EOL PHP sites told to move to a supported version.
match
Nexcess lists affected services, and patching is underway—but it has not confirmed that all environments are patched. As checked on October 23, 2026, its latest official update is dated October 22, 2026, at 15:27 EDT. Affected: Nexcess’s incident for both CVEs lists Cloud Dedicated, Cloud VPS Hosting, cPanel, InterWorx, and Plesk. This does not establish that every customer site
contradiction
I was unable to find any Nexcess-specific advisory, blog post, or statement addressing PHP2Shell (CVE-2026-109618 / CVE-2026-109619). There is no publicly available source confirming whether Nexcess has or has not patched this vulnerability on its platform, or issued guidance to its customers. You should contact Nexcess support directly for an authoritative answer. That said, here is what is known
match
Yes. Nexcess was affected where its infrastructure was running vulnerable PHP versions, because PHP2Shell affects PHP installations serving web requests, including PHP-FPM and Apache/mod_php. The fixed upstream PHP versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Nexcess reported on October 22, 2026 that most affected hosts had been patched and patching was still underway on the remaining hosts. Therefore, Nexcess
no status named
Yes, Nexcess was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and its security and engineering teams have rolled out patches across their hosting environments. Status & Patch Details Affected Systems: Nexcess infrastructure running PHP versions 5.4 and later was initially exposed to the critical RCE flaws. Patch Status: Nexcess has rolled out fixes across the majority of their
match
Yes, Nexcess is affected by PHP2Shell, and they have begun patching their hosting environments. Because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) impacts the core PHP engine itself (affecting versions 5.4 and later), all managed hosting environments running PHP are inherently vulnerable until updated. According to the official Nexcess Status Page, their security and engineering teams identified the threat on October 21,
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Nexcess reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Nexcess's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Nexcess and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy