Status in the company's own words: customer must update. Statement dated October 21, 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
News post Critical PHP Security Release by John Blackbourn (WordPress security team): Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. , No WordPress update is required or planned for these issues. and Versions of PHP prior to 8.2 no longer receive security updates from the PHP project. quoted from the statement URL. Site owners told to check with their host, which may already be patching PHP or deploying WAF rules; self-managed sites on older PHP advised to consider taking the server offline while upgrading. No CVE IDs, no PHP versions, no WordPress.org infrastructure statement. Automattic's own hosting statement is in the WooCommerce row.
Change log
: first check
What the five engines said
AI answers not yet measured
Submit a correction or your statement
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
Badge
The badge for WordPress (WordPress.org) reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
WordPress (WordPress.org)'s customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about WordPress (WordPress.org) and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
About this page
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.