Kimai and PHP2Shell

Is this your company?

Publish or update your statement. The statement submission is free.

See what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about you: the $490 PHP2Shell Record Check.

We capture the dated answers, trace wrong or missing statements to their sources and deliver a statement page in the format the engines quote.

Agencies: white-label PHP2Shell Record Check, $490 per client report.

The statement

All Kimai Cloud systems were updated within minutes after the official PHP releases were published.

Notes

All Kimai Cloud systems were updated within minutes after the official PHP releases were published. Post Critical PHP security update: what it means for Kimai users. Mixed: All Kimai Cloud systems were updated within minutes after the official PHP releases were published.; self-hosted installs must update PHP themselves and Docker users must pull updated images; Updating Kimai alone won't fix this: PHP itself has to be updated on every server that runs it. Both quoted from the statement URL. Release 2.70.1 (21 Oct) exists mainly to trigger a rebuild of our Docker images, which will the ship fixed PHP versions quoted from https://github.com/kimai/kimai/releases/tag/2.70.1. No CVE IDs named in the post.

Change log

• 23 October 2026: first check
• 24 October 2026: Official notice re-read and verbatim excerpt retained; classification and original printed date unchanged.

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

The badge for Kimai reads PHP2Shell statement listed, Verified 24 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.

Questions about Kimai and PHP2Shell

Is Kimai affected by PHP2Shell?

Kimai's PHP2Shell statement is recorded as patched, with statement date printed as 21 Oct 2026 (updates 21 Oct 10:00 and 21 Oct 19:30); source: https://www.kimai.org/blog/2026/php-cve.

The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.