Namecheap's PHP2Shell statement is recorded as patched partly, with statement date printed as Oct 21 2026 09:31:am America/New_York (initial); Update @ 7:00 PM EDT | 00:00 UTC (latest, no calendar date printed); read the published statement.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
All PHP versions offered on our Shared Hosting servers are patched against these vulnerabilities.
Read the statement on www.namecheap.com, dated Oct 21 2026 09:31:am America/New_York (initial); Update @ 7:00 PM EDT | 00:00 UTC (latest, no calendar date printed). Source type: status page.
Notes
All PHP versions offered on our Shared Hosting servers are patched against these vulnerabilities. quoted from https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/. Latest primary notice is titled [RESOLVED]. Its completion statement covers Shared Hosting, including backported fixes for PHP 5.2 to 8.1; all four fixed versions for PHP 8.2 to 8.5 are listed. The classification reflects that stated Shared Hosting scope. Earlier notice instructions leave customer-managed VPS and dedicated PHP updates with the customer. The latest printed time pair is Update @ 7:00 PM EDT | 00:00 UTC, without a calendar date; no completion date is inferred. No PHP-worker restart confirmation is stated.
Change log
: first check
: Source-only recheck completed; published classification unchanged.
: Primary-source update verified: Shared Hosting completion, fixed version numbers and older-version backports now stated. Status patching to patched partly preserves the explicitly limited product scope; undated latest update kept as printed.
: Source-only recheck completed; published classification unchanged.
What the five engines said
ChatGPT
differs
Captured . Status named: patched. Cites a namecheap.com page.
Yes—Namecheap confirmed its PHP hosting services were affected, and now reports that patching is complete. As checked on October 23, 2026, its official incident notice is marked [RESOLVED]. Affected: Namecheap identified PHP-based websites and applications across its hosting platforms as affected by CVE-2026-109618 and CVE-2026-109619. Patched: Following initial mitigations and a staged rollout, the notice’s 12:50 p.m. EDT completion
Captured . Status named: patching. Cites a namecheap.com page.
Yes — Namecheap is affected by PHP2Shell, has acknowledged it publicly, and is actively patching. Here is a full breakdown with sources: What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code on a web server without logging in. The PHP security team rates
Captured . No status named. Cites a namecheap.com page.
Yes. Namecheap was affected: its status notice says the vulnerabilities affected websites and applications running PHP on all versions and platforms. Patch status: Namecheap initially applied mitigations while awaiting PHP’s official fixes. After PHP released patched versions, Namecheap deployed them across its hosting infrastructure; its incident was subsequently marked resolved. Namecheap also reported that remaining server deployments were completed,
Captured . Status named: patched. Cites a namecheap.com page.
Affected Status: Yes, Namecheap's hosting services (including Dedicated Servers, Shared Servers, Reseller Servers, VPS, and general hosting platforms running PHP) were affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Patch Status: Namecheap has marked the security incident as [RESOLVED] on their status page following PHP's release of patched versions (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35). Source: You can read
Captured . No status named. Cites a namecheap.com page.
Yes, Namecheap's hosting services were affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which impact websites and applications running PHP on all platforms. Status: Resolved / Mitigated Namecheap Action: Namecheap put mitigation measures in place across all of their hosting platforms (including Shared, Dedicated, Reseller, VPS, and Hosting servers) to reduce the risk of exploitation while waiting for official
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
Badge
The badge for Namecheap reads PHP2Shell statement listed, Verified 24 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.
About this page
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.