PHP2Shell statement record · Platform
Laravel's PHP2Shell statement is recorded as patched, with statement date printed as Oct 21, 2026; Updated 10/23 - 08:31 UTC; read the published statement.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Publish or update your statement. The statement submission is free.
See what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about you: the $490 PHP2Shell Record Check.
We capture the dated answers, trace wrong or missing statements to their sources and deliver a statement page in the format the engines quote.
Agencies: white-label PHP2Shell Record Check, $490 per client report.
Read the statement on laravel.com, dated Oct 21, 2026; Updated 10/23 - 08:31 UTC. Source type: official page.We have patched every running application on Laravel Cloud with the PHP and Node.js security releases and deployments have resumed.
We have patched every running application on Laravel Cloud with the PHP and Node.js security releases and deployments have resumed.
Current official article confirms Laravel Cloud application patching and separately gives customer actions for Forge servers. Existing dated AI answers remain unchanged.
no status named
Yes—Laravel applications are affected when running on vulnerable PHP. Fixes are available, but the fix is a PHP runtime update, not a Laravel framework update. These CVEs concern PHP internals, and PHP warns that all installations serving web requests are at risk. Evidence that Laravel is affected The original Calif Research PHP2Shell write-up explicitly lists Laravel 13.11 among applications
no status named
Here is a comprehensive summary of what is known about PHP2Shell (CVE-2026-109618 & CVE-2026-109619) and its impact on Laravel: ⚠️ PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — Impact on Laravel What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code on a web server without logging
match
Yes. Laravel applications can be affected, but the vulnerability is in the underlying PHP runtime, not in Laravel’s framework code. An attacker can exploit vulnerable PHP before Laravel application code runs, so updating Laravel or running composer update does not remediate it. PHP released fixes on October 21, 2026: PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35 Therefore, Laravel
no status named
Laravel is not uniquely affected by a framework-specific vulnerability; instead, Laravel applications are affected if they run on a vulnerable version of the underlying PHP runtime (CVE-2026-109618 and CVE-2026-109619). Patch and Fix Details The Flaw: PHP2Shell is a core PHP engine flaw rather than a Laravel code defect. The Fix: The PHP Group released security updates on October 21,
no status named
Laravel itself as a PHP framework contains no direct vulnerability code for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), because these are critical core PHP engine vulnerabilities (rated 9.2 CVSS v4.0 for remote code execution via memory/OOM mismanagement). However, any Laravel application running on an unpatched version of PHP is vulnerable. Laravel applications do not need a framework patch; instead, the underlying
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Laravel reads PHP2Shell statement listed, Verified 24 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Laravel's PHP2Shell statement is recorded as patched, with statement date printed as Oct 21, 2026; Updated 10/23 - 08:31 UTC; source: https://laravel.com/blog/php-critical-vulnerability-response-updates.
The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy