Coolify's PHP2Shell statement is recorded as patched, with statement date printed as Oct 21, 2026; read the published statement.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Pinned issue Security: update Coolify now for PHP2Shell (CVE-2026-109618, CVE-2026-109619) by maintainer peaklabs-dev on the project's official GitHub repository: the flaws affect every Coolify v4 version. Update your instance immediately. and We backported the fix to every v4 line, so you can update without leaving your minior version. quoted from the issue URL. v4.4 users update from the dashboard; v4.0 to v4.3 users run the patch script, which restarts only the Coolify container; beta or older installs reinstall v4.0.1 then update to v4.4.7. Temporary PHP mitigations only if updating is impossible; also update Sentinel, cloudflared 2026.10.3 and own Node.js runtimes.
Change log
: first check
What the five engines said
AI answers not yet measured
Submit a correction or your statement
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
Badge
The badge for Coolify reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.
About this page
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.