PHP2Shell statement record · Host
Status in the company's own words: patched. Statement dated October 21, 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on automattic.com, dated . Source type: official page.
Statement is by parent company Automattic, which operates WordPress VIP: If your site is hosted on WordPress.com, WordPress VIP, WP Cloud, Pressable, or Tumblr, your site is already protected.
and There is nothing you need to do.
quoted from https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/ (author Rudy). Says protected; does not describe the fix applied to VIP and names no deployed build (the fixed PHP releases 8.5.12, 8.4.27, 8.3.36, 8.2.35 are listed as PHP's releases). PENDING: check wpvip.com own blog/security page.
match
WordPress VIP is already protected, according to Automattic—but its public notice does not explicitly confirm the deployed PHP patch versions. As of October 23, 2026, the official statement is that VIP-hosted sites are protected against both CVE-2026-109618 and CVE-2026-109619, with no customer action required. Automattic’s October 21, 2026 announcement states: > “If your site is hosted on WordPress.com, WordPress
match
Here is a comprehensive answer based on the latest sources: PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — WordPress VIP Status What is PHP2Shell? PHP2Shell is the name for two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. They are two CRITICAL-severity PHP core vulnerabilities that turn unauthenticated requests into remote code execution and Heartbleed-style memory
match
WordPress VIP was potentially affected at the PHP-runtime level, but Automattic says it was protected before or when the vulnerabilities were publicly disclosed. Automattic explicitly lists WordPress VIP among its platforms whose sites were already protected against PHP2Shell as of October 21, 2026. The vulnerabilities are in PHP itself, not WordPress core, themes, or plugins. PHP fixed them in
match
Impact: Yes, sites hosted on WordPress VIP use the PHP runtime and are technically exposed to the underlying PHP2Shell vulnerabilities (CVE-2026-109618 and ). Patch Status: Yes, WordPress VIP (along with related Automattic infrastructure like WordPress.com, WP Cloud, and Pressable) is already protected, and no action is required from site owners. Source: Official statements published by Automattic on Automattic News
no status named
Impact Status: Yes, WordPress VIP infrastructure relies on PHP—the underlying runtime affected by the critical PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). However, sites hosted on the platform were shielded immediately. Patch/Mitigation Status: Yes, the platform is fully protected. Automattic applied early platform-level mitigations and rolled out official PHP updates across the network as soon as the PHP
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for WordPress VIP reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
WordPress VIP's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about WordPress VIP and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy