PHP2Shell statement record · Platform
Status in the company's own words: mitigation only. Statement dated Oct 21, 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on github.com, dated Oct 21, 2026. Source type: official page.
Pinned issue PHP CVEs. Attention required!
opened 21 Oct 2026 by Nextcloud staff (kesselb) on the project's official GitHub repository, not on nextcloud.com; no further comments or edits as of the second read. We have been informed by CERT of an issue affecting PHP.
and We will release an update as soon as more information is known about affected PHP versions and availability of updates.
quoted from https://github.com/nextcloud/server/issues/65754. The post relays CERT's recommendation to turn off servers running PHP-based applications until PHP updates are available and applied; it names no CVE, no fixed PHP version, no restart or EOL guidance and no rebuilt image. Status reflects that only a take-offline measure is stated.
differs
Yes—Nextcloud deployments running vulnerable PHP are affected, and a patched Nextcloud AIO release is available. As of October 23, 2026, Nextcloud’s official warning confirms that the PHP issues affect Nextcloud and could allow server compromise and access to its data. The patch status depends on how you run Nextcloud: | Deployment | Patch status / required action | |---|---|
no status named
Yes, Nextcloud is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and a patch has been released. Here is a full breakdown: What is PHP2Shell? PHP2Shell refers to a set of memory-safety vulnerabilities in the core PHP engine, grouped under CVE-2026-109618 and CVE-2026-109619, publicly disclosed on 21 October 2026. The PHP security team rates both CVSSv4.0 9.2 and says they can
differs
Yes. Nextcloud is affected when it runs on a vulnerable PHP runtime, because PHP2Shell is a flaw in PHP itself—not in Nextcloud code. Reports identify Nextcloud among applications exposed to pre-authentication code execution on affected PHP versions. Patch status: Self-hosted/system PHP: Nextcloud does not bundle or patch the host’s PHP runtime. Upgrade PHP to at least 8.2.35, 8.3.36, 8.4.27,
no status named
Nextcloud itself is not vulnerable by its own application code, but Nextcloud servers are affected if they run on a vulnerable version of PHP. Are Nextcloud servers affected? The Flaw: PHP2Shell (CVE-2026-109618 and CVE-2026-109619 ) is a vulnerability in the PHP language engine/runtime, not Nextcloud's codebase. Impact: Any web application running on an unpatched PHP version—including Nextcloud, WordPress, and
no status named
Yes, Nextcloud is implicitly affected because Nextcloud is built on PHP and relies on the underlying PHP runtime environment. The "PHP2Shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reside in the PHP core language runtime itself, meaning any application-level software running on an unpatched PHP version is exposed to unauthenticated remote code execution (RCE). Impact and Status Vulnerability Nature: These critical core
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Nextcloud reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Nextcloud's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Nextcloud and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy