PHP2Shell statement record · Host
Nexcess's PHP2Shell statement is recorded as patching, with statement date printed as Latest update Oct 23, 2026 - 22:25 EDT; read the published statement.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Publish or update your statement. The statement submission is free.
See what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about you: the $490 PHP2Shell Record Check.
We capture the dated answers, trace wrong or missing statements to their sources and deliver a statement page in the format the engines quote.
Agencies: white-label PHP2Shell Record Check, $490 per client report.
Read the statement on status.nexcess.com, dated Latest update Oct 23, 2026 - 22:25 EDT. Source type: status page.Patch deployment is ongoing across our fleet. We appreciate your continued patience.
Patch deployment is ongoing across our fleet. We appreciate your continued patience.
The latest official update explicitly says patch deployment remains ongoing. No completion is inferred from the availability of package builds. Existing supported-version migration guidance remains in the source.
match
Nexcess lists affected services, and patching is underway—but it has not confirmed that all environments are patched. As checked on October 23, 2026, its latest official update is dated October 22, 2026, at 15:27 EDT. Affected: Nexcess’s incident for both CVEs lists Cloud Dedicated, Cloud VPS Hosting, cPanel, InterWorx, and Plesk. This does not establish that every customer site
contradiction
I was unable to find any Nexcess-specific advisory, blog post, or statement addressing PHP2Shell (CVE-2026-109618 / CVE-2026-109619). There is no publicly available source confirming whether Nexcess has or has not patched this vulnerability on its platform, or issued guidance to its customers. You should contact Nexcess support directly for an authoritative answer. That said, here is what is known
match
Yes. Nexcess was affected where its infrastructure was running vulnerable PHP versions, because PHP2Shell affects PHP installations serving web requests, including PHP-FPM and Apache/mod_php. The fixed upstream PHP versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Nexcess reported on October 22, 2026 that most affected hosts had been patched and patching was still underway on the remaining hosts. Therefore, Nexcess
no status named
Yes, Nexcess was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and its security and engineering teams have rolled out patches across their hosting environments. Status & Patch Details Affected Systems: Nexcess infrastructure running PHP versions 5.4 and later was initially exposed to the critical RCE flaws. Patch Status: Nexcess has rolled out fixes across the majority of their
match
Yes, Nexcess is affected by PHP2Shell, and they have begun patching their hosting environments. Because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) impacts the core PHP engine itself (affecting versions 5.4 and later), all managed hosting environments running PHP are inherently vulnerable until updated. According to the official Nexcess Status Page, their security and engineering teams identified the threat on October 21,
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Nexcess reads PHP2Shell statement listed, Verified 24 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Nexcess's PHP2Shell statement is recorded as patching, with statement date printed as Latest update Oct 23, 2026 - 22:25 EDT; source: https://status.nexcess.com/incidents/n4fpf22f5xtf.
The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy