PHP2Shell statement record · Platform
Cisco's PHP2Shell statement is recorded as customer must update, with statement date printed as 2026 October 21 19:12 GMT; Last Updated 2026 October 23 22:39 GMT, Version 1.6 Interim; read the published statement.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Publish or update your statement. The statement submission is free.
See what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about you: the $490 PHP2Shell Record Check.
We capture the dated answers, trace wrong or missing statements to their sources and deliver a statement page in the format the engines quote.
Agencies: white-label PHP2Shell Record Check, $490 per client report.
Read the statement on sec.cloudapps.cisco.com, dated 2026 October 21 19:12 GMT; Last Updated 2026 October 23 22:39 GMT, Version 1.6 Interim. Source type: official page.For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products section of this advisory.
For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products section of this advisory.
Official interim advisory now lists product-specific customer software actions. Duo Access Gateway 3.2.0 is listed; other named product fixes are future or undated, with product-specific workarounds. Other Cisco products are confirmed not vulnerable or remain under investigation. The earlier blanket not-affected classification is withdrawn; no conclusion about every Cisco product is inferred. Read the linked advisory for the current product table.
no status named
Yes—some Cisco products are confirmed affected, but Cisco’s advisory does not yet list an available patch for them. As of October 23, 2026, the latest advisory is version 1.4, updated October 22, 2026, at 23:00 GMT, covering both CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). | Confirmed affected product | Fix listed by Cisco | Availability | |---|---|---| | Ultra-Reliable Wireless Backhaul
no status named
Here is a comprehensive summary of Cisco's status regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619), based on the latest available sources: 🔍 What Is PHP2Shell? CVE-2026-109618 and CVE-2026-109619 are critical remote code execution (RCE) vulnerabilities in PHP. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. CVE-2026-109618 stems from how PHP handles out-of-memory
no status named
Cisco has not confirmed any affected products for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) as of its October 22, 2026 advisory. However, Cisco is still investigating multiple products and cloud services, so this is not yet a definitive “not affected” determination. Cisco’s advisory does not list a Cisco product-level patch or fixed release, and it says there are no workarounds. If
no status named
Cisco is currently investigating its product line for potential exposure to PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Investigation Status: In its official advisory, Cisco stated that it is reviewing roughly 30 of its products and cloud services (including Identity Services Engine, Catalyst Center, and the AppDynamics PHP Agent). Current Confirmation: As of the latest update, Cisco has not confirmed any products
no status named
Cisco is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) if it runs vulnerable PHP runtime engines in its software or appliances, and Cisco Talos has issued network intrusion prevention (SNORT) signatures rather than direct universal software patches for all third-party components. Affected Scope & Details The Vulnerability: PHP2Shell consists of two critical memory-safety remote code execution (RCE) flaws
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Cisco reads PHP2Shell statement listed, Verified 24 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Cisco's PHP2Shell statement is recorded as customer must update, with statement date printed as 2026 October 21 19:12 GMT; Last Updated 2026 October 23 22:39 GMT, Version 1.6 Interim; source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq.
The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy