PHP2Shell statement record · Platform
Status in the company's own words: patched. Statement dated Oct 21, 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on developer.woocommerce.com, dated Oct 21, 2026. Source type: official page.
Post Critical Security Releases for PHP
(Advisories). Mixed: Automattic's own platforms WordPress.com, WordPress VIP, Pressable and WP Cloud are described as already protected; everyone else must update PHP themselves. Due to the critical severity of the issues, store owners are encouraged to immediately update their installations of PHP.
and No WooCommerce or WordPress update is required or planned for these issues.
quoted from https://developer.woocommerce.com/2026/10/21/php-security-release/. PHP before 8.2 no longer receives security updates; WooCommerce recommends PHP 8.3 or newer; self-managed servers on older PHP advised to consider going offline while upgrading. No CVE IDs and no fixed PHP versions named.
match
As of October 23, 2026: WooCommerce’s specific status is still “under investigation”—not confirmed unaffected, and not confirmed patched. PHP itself has released fixes. Is WooCommerce affected? The Dutch National Cyber Security Centre’s (NCSC-NL) tracker lists WooCommerce as “Investigation” for both CVE-2026-109618 and CVE-2026-109619, stating: “PHP relationship confirmed; CVE match unknown.” This is not confirmation that every WooCommerce installation is
match
Here is a comprehensive answer about WooCommerce and PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Is WooCommerce Affected by PHP2Shell? What is PHP2Shell? The PHP development team released emergency security updates to fix PHP2Shell — two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. CVE-2026-109618: RCE via out-of-memory corruption — when memory
match
Yes. WooCommerce is affected when it runs on a vulnerable PHP runtime, because PHP2Shell is a flaw in the PHP engine—not in WooCommerce itself. Stores running PHP versions dating back to 5.4 may be exposed, regardless of whether WooCommerce’s own code is clean. WooCommerce has not been “patched” as a plugin; the required fix is to patch PHP. PHP
no status named
WooCommerce is not specifically affected, because the CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell") vulnerabilities are flaws in the PHP runtime core itself, not in WooCommerce or WordPress code. Patch Status: No WooCommerce or WordPress code patch is required or planned. Instead, the underlying PHP runtime needs to be updated by your server or hosting provider to patched PHP versions (8.5.12, 8.4.27,
no status named
Affected Status: WooCommerce itself is not a vulnerable component, but any server running WooCommerce on top of a vulnerable PHP core language runtime version is indirectly affected. The flaws (CVE-2026-109618 and CVE-2026-109619, known as "PHP2Shell") reside within PHP's core memory/request handling rather than WooCommerce application code. Because WooCommerce requires PHP to run, any underlying environment utilizing an unpatched PHP
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for WooCommerce, Automattic reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
WooCommerce, Automattic's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about WooCommerce, Automattic and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy