PHP2Shell statement record · Host
Pantheon's PHP2Shell statement is recorded as patched partly, with statement date printed as Resolved Oct 22, 2026 - 09:36 PDT; earlier Monitoring Oct 21, 2026 - 19:08 PDT; read the published statement.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Publish or update your statement. The statement submission is free.
See what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about you: the $490 PHP2Shell Record Check.
We capture the dated answers, trace wrong or missing statements to their sources and deliver a statement page in the format the engines quote.
Agencies: white-label PHP2Shell Record Check, $490 per client report.
Read the statement on status.pantheon.io, dated Resolved Oct 22, 2026 - 09:36 PDT; earlier Monitoring Oct 21, 2026 - 19:08 PDT. Source type: status page.Our rollout of updated PHP images across customer environments including LTS versions was complete as of 5pm Pacific time yesterday.
Our rollout of updated PHP images across customer environments including LTS versions was complete as of 5pm Pacific time yesterday.
Official resolution is dated 22 October 2026, 09:36 PDT. It reports completion across customer environments including LTS. The earlier notice separately schedules free/sandbox environments; this read does not infer their later completion. Status remains patched partly to preserve that distinction.
differs
Yes—Pantheon treated its hosted PHP environments as affected and has deployed patches. As of October 23, 2026, its official incident is marked Resolved, with the final update posted October 22 at 9:36 a.m. PDT. Pantheon’s patching timeline: October 21, 12:49 p.m. PDT: All live production sites running PHP 8.2–8.5 patched. October 21, 5:16 p.m. PDT: Production patching completed for
differs
Here is a comprehensive summary of what is known about Pantheon's exposure to and response to PHP2Shell (CVE-2026-109618 & CVE-2026-109619): What Is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell, are two Remote Code Execution vulnerabilities in PHP. Both are rated CVSS v4.0 9.2. The bugs allow unauthenticated remote code execution and Heartbleed-style memory disclosure in PHP itself, independent
differs
Yes. Pantheon was affected because its managed PHP runtimes used vulnerable PHP branches, but it has patched the relevant production environments. Pantheon patched live production sites running supported PHP 8.2–8.5 with PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, the fixed upstream releases. Pantheon also completed patching LTS environments and SFTP-mode environments, and reported that most paid non-live environments were patched.
differs
Yes, Pantheon environments running vulnerable PHP versions were affected by the PHP2Shell vulnerabilities ( and CVE-2026-109619), and the platform has actively rolled out patches and runtime/network mitigations. Rollout Status & Patch Details Affected Sites: Platforms running PHP versions prior to the emergency releases (PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12) or legacy/LTS branches were exposed to the critical remote code
differs
Yes, Pantheon was affected by the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which are core PHP remote code execution flaws. Yes, Pantheon has patched it. Live and Pre-production Environments: Pantheon rolled out updated PHP container images across all live and pre-production customer environments (including supported LTS versions), completing the rollout by October 21, 2026. Free/Sandbox Environments: Scheduled for updates
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Pantheon reads PHP2Shell statement listed, Verified 24 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Pantheon's PHP2Shell statement is recorded as patched partly, with statement date printed as Resolved Oct 22, 2026 - 09:36 PDT; earlier Monitoring Oct 21, 2026 - 19:08 PDT; source: https://status.pantheon.io/incidents/x7h8z1yhgvml.
The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy