OVHcloud's PHP2Shell statement is recorded as patched partly, with statement date printed as Latest patch update Oct 23, 2026 - 17:07 UTC; earlier 7.4 to 8.5 completion Oct 21, 2026 - 17:53 UTC; read the published statement.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Our technical team has completed the deployment of the patch for PHP versions 5.3 through 7.3. The latest Web Hosting update adds completion for PHP 5.3 through 7.3; an earlier update confirms 7.4 through 8.5. Scope remains the named Web Hosting clusters; VPS and dedicated servers are not established by this notice. The published maintenance end remains 26 October 2026, 18:00 UTC. Status remains patched partly.
Change log
: first check
: Source-only recheck completed; published classification unchanged.
: Primary source re-read; current statement scope, date or excerpt updated.
What the five engines said
ChatGPT
differs
Captured . Status named: patched.
Yes—OVHcloud’s Web Hosting service was affected, and OVHcloud confirms it has patched PHP 7.4–8.5 across all its hosting clusters. Older PHP versions are not yet confirmed patched. This is the status as of October 23, 2026. OVHcloud’s official status notice explicitly names CVE-2026-109618 and CVE-2026-109619 and gives this timeline: October 21, 08:00 UTC: Initial workaround implemented; OVHcloud subsequently reported
Captured . Status named: patched. Cites a ovhcloud.com page.
Here is a comprehensive summary of OVHcloud's exposure to and response regarding PHP2Shell (CVE-2026-109618 & CVE-2026-109619): What is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are both rated CVSS v4.0 9.2. Both CVEs are use-after-free bugs: CVE-2026-109618 involves an upload-progress unserializer use-after-free leading to remote memory disclosure and RCE, while CVE-2026-109619 involves a fatal-error backtrace use-after-free and OPcache
Captured . No status named. Cites a ovhcloud.com page.
Yes—OVHcloud is affected where customers run PHP on Bare Metal servers or VPS instances, because PHP versions before the fixed releases are vulnerable. OVHcloud says WebCloud/shared-hosting customers are automatically covered by an updated PHP component. OVHcloud’s remediation status is: Web Hosting: OVHcloud deployed fixes across its Web Hosting clusters; the provider’s status indicates PHP 7.4–8.5 are patched. This status
Captured . No status named. Cites a ovhcloud.com page.
Yes, OVHcloud infrastructure running PHP versions 7.4 through 8.5 was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and OVHcloud has implemented emergency workarounds and deployed patches. Summary of OVHcloud Status and Actions Impact: Affected systems include PHP sites running on OVHcloud Web Hosting clusters, Public Cloud instances, and Bare Metal servers (such as Kimsufi, So you Start, Rise,
Captured . Status named: patching. Cites a ovhcloud.com page.
Affected status: Yes, infrastructure running PHP (such as Bare Metal and VPS hosted environments) managed or provided by OVHcloud is inherently exposed to the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) if running unpatched PHP versions. Patch status: Official upstream patches for PHP were released by the PHP group on October 21, 2026. For OVHcloud customers using Bare
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
Badge
The badge for OVHcloud reads PHP2Shell statement listed, Verified 24 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Questions about OVHcloud and PHP2Shell
Is OVHcloud affected by PHP2Shell?
OVHcloud's PHP2Shell statement is recorded as patched partly, with statement date printed as Latest patch update Oct 23, 2026 - 17:07 UTC; earlier 7.4 to 8.5 completion Oct 21, 2026 - 17:53 UTC; source: https://web-cloud.status-ovhcloud.com/incidents/6ct3ggp512xk.
The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.
About this page
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.