PHP2Shell statement record · Host
Status in the company's own words: patched partly. Statement dated Oct 22, 2026 - 14:12 UTC (latest; patch update Oct 21, 2026 - 17:53 UTC).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on web-cloud.status-ovhcloud.com, dated Oct 22, 2026 - 14:12 UTC (latest; patch update Oct 21, 2026 - 17:53 UTC). Source type: status page.All php release from 7.4 to 8.5 have been patch on all clusters.
All php release from 7.4 to 8.5 have been patch on all clusters.
and We are actually working on the previous release.
(Oct 21, 2026 - 17:53 UTC) quoted from https://web-cloud.status-ovhcloud.com/incidents/6ct3ggp512xk (title: [GLOBAL][Web Hosting] - All clusters maintenance notification; OVHcloud's status site). Web Hosting clusters only (GRA and BHS); VPS and dedicated not mentioned. WAF rules modified on all clusters (14:50 UTC); Service reload will slowdown customers services.
; maintenance window extended to 26/10/2026 18:00 UTC (Oct 22 update). Older releases (below 7.4) still in progress.
differs
Yes—OVHcloud’s Web Hosting service was affected, and OVHcloud confirms it has patched PHP 7.4–8.5 across all its hosting clusters. Older PHP versions are not yet confirmed patched. This is the status as of October 23, 2026. OVHcloud’s official status notice explicitly names CVE-2026-109618 and CVE-2026-109619 and gives this timeline: October 21, 08:00 UTC: Initial workaround implemented; OVHcloud subsequently reported
differs
Here is a comprehensive summary of OVHcloud's exposure to and response regarding PHP2Shell (CVE-2026-109618 & CVE-2026-109619): What is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are both rated CVSS v4.0 9.2. Both CVEs are use-after-free bugs: CVE-2026-109618 involves an upload-progress unserializer use-after-free leading to remote memory disclosure and RCE, while CVE-2026-109619 involves a fatal-error backtrace use-after-free and OPcache
no status named
Yes—OVHcloud is affected where customers run PHP on Bare Metal servers or VPS instances, because PHP versions before the fixed releases are vulnerable. OVHcloud says WebCloud/shared-hosting customers are automatically covered by an updated PHP component. OVHcloud’s remediation status is: Web Hosting: OVHcloud deployed fixes across its Web Hosting clusters; the provider’s status indicates PHP 7.4–8.5 are patched. This status
no status named
Yes, OVHcloud infrastructure running PHP versions 7.4 through 8.5 was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and OVHcloud has implemented emergency workarounds and deployed patches. Summary of OVHcloud Status and Actions Impact: Affected systems include PHP sites running on OVHcloud Web Hosting clusters, Public Cloud instances, and Bare Metal servers (such as Kimsufi, So you Start, Rise,
differs
Affected status: Yes, infrastructure running PHP (such as Bare Metal and VPS hosted environments) managed or provided by OVHcloud is inherently exposed to the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) if running unpatched PHP versions. Patch status: Official upstream patches for PHP were released by the PHP group on October 21, 2026. For OVHcloud customers using Bare
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for OVHcloud reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
OVHcloud's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about OVHcloud and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy