PHP2Shell statement record · Host
Status in the company's own words: patched partly. Statement dated Oct 21, 2026 - 19:08 PDT (Monitoring; first Oct 21, 2026 - 07:03 PDT).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on status.pantheon.io, dated Oct 21, 2026 - 19:08 PDT (Monitoring; first Oct 21, 2026 - 07:03 PDT). Source type: status page.Patched PHP builds have been deployed to all LTS environments, all environments in SFTP mode, and all live environments running PHP 8.2 or later.
Patched PHP builds have been deployed to all LTS environments, all environments in SFTP mode, and all live environments running PHP 8.2 or later.
and all pre-production customer environments are patched. Free/sandbox environments will be updated over the next 24-48 hours.
quoted from https://status.pantheon.io/incidents/x7h8z1yhgvml (title: PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619). Network mitigations remain in place; no customer action required; customers on End of Sale PHP versions advised to move to a supported version.
differs
Yes—Pantheon treated its hosted PHP environments as affected and has deployed patches. As of October 23, 2026, its official incident is marked Resolved, with the final update posted October 22 at 9:36 a.m. PDT. Pantheon’s patching timeline: October 21, 12:49 p.m. PDT: All live production sites running PHP 8.2–8.5 patched. October 21, 5:16 p.m. PDT: Production patching completed for
differs
Here is a comprehensive summary of what is known about Pantheon's exposure to and response to PHP2Shell (CVE-2026-109618 & CVE-2026-109619): What Is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell, are two Remote Code Execution vulnerabilities in PHP. Both are rated CVSS v4.0 9.2. The bugs allow unauthenticated remote code execution and Heartbleed-style memory disclosure in PHP itself, independent
differs
Yes. Pantheon was affected because its managed PHP runtimes used vulnerable PHP branches, but it has patched the relevant production environments. Pantheon patched live production sites running supported PHP 8.2–8.5 with PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, the fixed upstream releases. Pantheon also completed patching LTS environments and SFTP-mode environments, and reported that most paid non-live environments were patched.
differs
Yes, Pantheon environments running vulnerable PHP versions were affected by the PHP2Shell vulnerabilities ( and CVE-2026-109619), and the platform has actively rolled out patches and runtime/network mitigations. Rollout Status & Patch Details Affected Sites: Platforms running PHP versions prior to the emergency releases (PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12) or legacy/LTS branches were exposed to the critical remote code
differs
Yes, Pantheon was affected by the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which are core PHP remote code execution flaws. Yes, Pantheon has patched it. Live and Pre-production Environments: Pantheon rolled out updated PHP container images across all live and pre-production customer environments (including supported LTS versions), completing the rollout by October 21, 2026. Free/Sandbox Environments: Scheduled for updates
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Pantheon reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Pantheon's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Pantheon and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy