PHP2Shell statement record · Host
Status in the company's own words: patched. Statement dated 10/21/2026 08:19:42PM CDT (CLOSED, Resolved; created 10/21/2026 08:40:00AM CDT).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on wpenginestatus.com, dated 10/21/2026 08:19:42PM CDT (CLOSED, Resolved; created 10/21/2026 08:40:00AM CDT). Source type: status page.WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on our platform. The patches have been applied to your PHP version, and no action is needed from you.
WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on our platform. The patches have been applied to your PHP version, and no action is needed from you.
quoted from https://wpenginestatus.com/incidents/969801 (incident: PHP Security Update; wpenginestatus.com is WP Engine's status page). Updated PHP versions listed: 7.4.33.17, 8.2.35, 8.4.27, 8.5.12 (all versions running on the platform, including 7.4). Earlier updates: protective mitigations at the CDN layer via Cloudflare and Fastly and at the hosting layer (10/21/2026 08:40:00AM CDT and 12:30:00PM CDT).
match
WP Engine treated PHP2Shell as applicable to its platform and has since reported all customer sites patched. As of October 23, 2026, the available updates show: Initial response, October 21: WP Engine’s official status notice said it was rolling out PHP patches across customer platforms and had already deployed Cloudflare/Fastly CDN mitigations. This was a patching-in-progress notice—not a claim
differs
Based on the search results, here is what is known about WP Engine and PHP2Shell (CVE-2026-109618 & CVE-2026-109619): PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — WP Engine Status What is PHP2Shell? PHP2Shell refers to two critical PHP vulnerabilities that could lead to unauthenticated remote code execution. Patches are available for supported PHP 8.x branches, and exploitation attempts began before public disclosure.
differs
Yes—WP Engine was affected, because PHP2Shell is a vulnerability in the PHP runtime, not WordPress itself. WP Engine reportedly ran vulnerable PHP branches and was still rolling out fixes as of October 22, 2026, with mitigations in place during deployment. The available source says WP Engine planned to update all PHP versions it operates—7.4, 8.2, 8.4, and 8.5—but does
no status named
Yes, WP Engine was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the platform has applied patches across its servers. Impact: WP Engine hosts WordPress sites that rely on the underlying PHP runtime, which was vulnerable to unauthenticated remote code execution flaws rated 9.2 CVSS v4.0. Mitigations & Patching: WP Engine implemented initial network and CDN-layer mitigations (via
no status named
Affected Status: Yes, WP Engine's servers and hosting environments run PHP, meaning the platform was technically exposed to the underlying critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) before updates were finalized. Patch Status: Yes, WP Engine has addressed the issue. According to customer communications and developer reports, WP Engine implemented network and server-level mitigations even before PHP officially released its
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for WP Engine reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
WP Engine's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about WP Engine and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy