PHP2Shell statement record · Host
Status in the company's own words: patched. Statement dated October 21, 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on wordpress.com, dated . Source type: official page.Your sites are already protected against the recently disclosed PHP security issues.
Your sites are already protected against the recently disclosed PHP security issues.
and On WordPress.com, PHP is installed, maintained, and patched by us at the infrastructure level, not by you.
quoted from https://wordpress.com/blog/2026/10/21/php2shell-vulnerabilities/ (author Ian Stewart). Statement says protected, names no fixed build; status recorded as patched on the company's own words that PHP is patched by it and nothing is needed from customers. Parent post https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/ (October 21, 2026) lists PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 as the fixed releases and says If you are on PHP 8.1 or older, plan to move now.
(that advice is for self-managed servers).
differs
WordPress.com says all hosted sites are protected against PHP2Shell, and customers need take no action. Its announcement was published on October 21, 2026. Automattic’s corresponding advisory explicitly identifies CVE-2026-109618 and CVE-2026-109619. There is an important distinction about “has it patched?”: WordPress.com says it manages PHP patching at the infrastructure level and that every site is covered. However, these announcements
match
Based on the search results, I can provide a detailed answer. However, I must note an important caveat upfront: none of the search results contain any specific statement from Automattic/WordPress.com confirming or denying whether WordPress.com (the managed hosting platform) has patched PHP2Shell on its infrastructure. Here is what is known: PHP2Shell (CVE-2026-109618 & CVE-2026-109619): WordPress & WordPress.com What is
match
Yes—WordPress.com was potentially within the affected ecosystem because PHP2Shell is a vulnerability in PHP itself, not WordPress, but Automattic states that sites hosted on WordPress.com were protected as soon as possible. Its notice explicitly says: “If your site is hosted on WordPress.com … your site is already protected.” Automattic says it worked with the PHP Security team to protect
match
Yes, sites hosted on WordPress.com are protected against the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and Automattic has already ensured those services are secured. Source and Details Source: The Repository and reporting on Automattic's official blog statements. Status: Automattic's Artistic Director and Product Lead Ian Stewart stated that WordPress.com, WordPress VIP, WP Cloud, and Pressable were already protected against PHP2Shell
no status named
Affected Status: WordPress.com (hosted directly by Automattic) and Tumblr were exposed to the underlying PHP runtime risks of the "PHP2Shell" flaws (CVE-2026-109618 and CVE-2026-109619), but Automattic confirmed that hosted infrastructure was secured. Patch Status: Yes, it has been patched. Automattic explicitly stated that websites hosted directly on WordPress.com are safe and protected following the emergency PHP core updates. (Note:
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for WordPress.com reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
WordPress.com's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about WordPress.com and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy