Status in the company's own words: mitigation only. Statement dated undated (fetched 2026-10-23T00:38Z).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Vercel deployed WAF protections before public disclosure.These rules reduce exposure to known exploit patterns, but do not replace patching.Upgrade the PHP runtime to a patched release immediately, regardless of WAF protections or hosting provider. quoted from https://vercel.com/kb/bulletin/php2shell-security-bulletin (title: PHP security advisory: php2shell (CVE-2026-109618, CVE-2026-109619); Author: Security Team; no date printed). WAF rules apply automatically to all projects at no cost, covering PHP functions on Vercel and rewrites/proxies to external PHP backends. PHP 8.1 and earlier no longer receive regular updates from the PHP project.
Change log
: first check
What the five engines said
AI answers not yet measured
Submit a correction or your statement
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
Badge
The badge for Vercel reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Vercel's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Vercel and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
About this page
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.