PHP2Shell statement record · Host
Status in the company's own words: mitigation only. Statement dated Oct 21, 2026 (body: Last updated: 21 October 2026, 11:30 UTC).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on www.siteground.com, dated Oct 21, 2026 (body: Last updated: 21 October 2026, 11:30 UTC). Source type: official page.rolled out server-level mitigation rules across all SiteGround servers.
rolled out server-level mitigation rules across all SiteGround servers.
We disabled the affected functionalities on all supported PHP versions.
You don't need to update anything or change your PHP version.
quoted from https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026 (author Aleksandar Kolev). Post written before the 14:00 UTC release; body says We'll update this post once PHP publishes its security release.
No visible update on patched builds as of this check (page metadata modified 2026-10-22T07:00:49+00:00).
differs
SiteGround says it has patched both CVE-2026-109618 and CVE-2026-109619 across all its servers, and hosted customers are protected. Its latest advisory update is dated October 22, 2026, at 12:00 UTC. Affected? SiteGround treated the vulnerabilities as applicable to its PHP environment and initially disabled affected functionality across all supported PHP versions. It now reports that customers are protected—not that
no status named
Yes — SiteGround was affected by PHP2Shell, and it has confirmed that patches are fully applied. Here is a detailed breakdown: What is PHP2Shell? PHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). Both are rated 9.2 on the CVSS v4.0 scale. CVE-2026-109618 – RCE via OOM corruption:
differs
Yes—SiteGround says its customers were protected before the official PHP fixes, through server-level mitigations that disabled the affected functionality across its servers. After PHP released the patches on October 21, 2026, SiteGround says it applied the official fixes across all servers. The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. SiteGround states that hosted customers do not need
no status named
Yes, SiteGround is protected and has already applied the necessary patches across all of its servers. Key Details Status: SiteGround mitigated the issue at the server level prior to the release and applied PHP's official patches across all supported PHP versions on October 21, 2026. Action Required: None. SiteGround manages PHP updates at the server level, so hosted websites
no status named
Impact on SiteGround: Sites hosted on SiteGround were protected prior to the official release of the patches through proactive server-level mitigations, and official fixes were applied immediately after PHP released updated versions. Action Required: Clients do not need to perform any manual updates, change settings, or switch PHP versions. Source: Official details and confirmation are available on the SiteGround
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for SiteGround reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
SiteGround's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about SiteGround and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy