PHP2Shell statement record · Host
DreamHost's PHP2Shell statement is recorded as patched, with statement date printed as October 23, 2026 11:26AM PDT (RESOLVED; first October 21, 2026 6:46AM PDT); read the published statement.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Publish or update your statement. The statement submission is free.
See what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about you: the $490 PHP2Shell Record Check.
We capture the dated answers, trace wrong or missing statements to their sources and deliver a statement page in the format the engines quote.
Agencies: white-label PHP2Shell Record Check, $490 per client report.
Read the statement on www.dreamhoststatus.com, dated October 23, 2026 11:26AM PDT (RESOLVED; first October 21, 2026 6:46AM PDT). Source type: status page.PHP’s security fix is now installed across all DreamHost servers, including Shared, Dedicated, VPS, and DreamPress. Sites on PHP 8.1 and older are also covered under our PHP Extended Support program.
PHP’s security fix is now installed across all DreamHost servers, including Shared, Dedicated, VPS, and DreamPress. Sites on PHP 8.1 and older are also covered under our PHP Extended Support program.
quoted from https://www.dreamhoststatus.com/pages/incident/575f0f606826303142000510/6ad8c218a7031204d4ca2981. DreamHost now marks the incident RESOLVED at October 23, 2026 11:26AM PDT. Its own notice says the PHP security fix is installed across all DreamHost servers, including Shared, Dedicated, VPS and DreamPress, and confirms coverage of PHP 8.1 and older through PHP Extended Support. No exact fixed PHP version numbers or PHP-worker restart confirmation is stated. The direct incident URL was successfully read for this update; earlier access-failure entries remain historical.
differs
Yes—DreamHost treated its PHP hosting infrastructure as affected, and says patching is complete. As of October 23, 2026, its latest official update reports that PHP security updates have been deployed across its entire network. The incident covers shared hosting, Managed VPS, DreamPress, and dedicated hosting. DreamHost’s timeline: October 21: Protections were in place, followed by rollout of the official
contradiction
Based on my thorough search of available sources, I found extensive information about PHP2Shell (CVE-2026-109618 and CVE-2026-109619), but no public statement, advisory, blog post, or announcement from DreamHost specifically addressing these vulnerabilities has appeared in any search results. Here is a full breakdown of what is known: ⚠️ DreamHost — No Public Statement Found There is no publicly available
match
Yes—DreamHost was affected because its servers run PHP, and PHP2Shell affected all PHP installations serving web requests. DreamHost reportedly said it was rolling out PHP’s fix across all servers, while blocking known attack paths in the interim, as of October 21, 2026. The available report does not confirm that the rollout was fully completed; it says only that deployment
differs
DreamHost is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the provider is actively rolling out fixes across its network while deploying temporary firewall protections. Affected Status: DreamHost servers and shared hosting environments initially ran unpatched PHP runtimes. Patch Progress: DreamHost reported that the fixed PHP builds were rolling out to the bulk of its network, with final
match
Yes, DreamHost's hosting infrastructure was potentially exposed because the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affect the core PHP engine runtime itself rather than a specific web application. DreamHost's Status & Patching Mitigation & WAF Protection: DreamHost's Operations and Technical teams deployed immediate mitigations across all hosting platforms (Shared, VPS, DreamPress, and Dedicated). Their Web Application Firewall (WAF) was configured
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for DreamHost reads PHP2Shell statement listed, Verified 24 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
DreamHost's PHP2Shell statement is recorded as patched, with statement date printed as October 23, 2026 11:26AM PDT (RESOLVED; first October 21, 2026 6:46AM PDT); source: https://www.dreamhoststatus.com/pages/incident/575f0f606826303142000510/6ad8c218a7031204d4ca2981.
The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy