--- title: "PHP2Shell Hosting Status: Is Your Host Patched Yet?" slug: "php2shell-hosting-status" description: "A host-by-host tracker of who has patched PHP2Shell, who only mitigated, and what you still have to do yourself on shared, VPS and managed hosting." date: 2026-10-22 modified: 2026-10-22 author: "WP Vanguard Team" category: "News" palette: "crit" tags: ["php2shell-hosting-status", "php-security-update-hosting", "managed-wordpress-hosting", "php-patch"] offer: "agency" featured_image: "/images/blog/php2shell-hosting-status.jpg" --- Most of the big managed WordPress hosts patched PHP2Shell within hours of the PHP release on October 21, 2026. GoDaddy's managed WordPress platform and Pantheon both posted "patched" statements about six hours after the release, and Cloudways, DreamHost, Liquid Web and Namecheap were still finishing rollouts into October 22. If your host handles PHP for you, you probably don't have to do anything. If you run a VPS, a dedicated server or an unmanaged plan, the patch is your job, and so is PHP 8.1 or older on most hosts. This page tracks what each host has said, last checked at 11:30 UTC on October 22, 2026. For what the flaws are and why they matter, read our [PHP2Shell explainer](/blog/php2shell-wordpress-php-update). ## What happened on October 21 The PHP project shipped fixes for CVE-2026-109618 and CVE-2026-109619 at about 14:00 UTC on October 21. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Several hosts and Cloudflare had protections live hours before that, because vendors got advance notice. ```timeline {"title": "October 21, 2026 (UTC)", "highlight": 3, "data": [ {"label": "03:02", "sub": "Cloudflare", "text": "Default WAF protection switched on for free and paid plans"}, {"label": "09:16", "sub": "Cloudways", "text": "Interim configuration mitigations begin"}, {"label": "11:30", "sub": "SiteGround", "text": "Says affected functions are disabled on all supported PHP versions"}, {"label": "~14:00", "sub": "PHP release", "text": "Fixed versions published"}, {"label": "19:30", "sub": "GoDaddy", "text": "Managed WordPress reported patched on all PHP versions"}, {"label": "19:49", "sub": "Pantheon", "text": "Live sites on PHP 8.2 to 8.5 reported patched"} ]} ``` Every time on this page is as posted on that host's own status page or announcement. Status pages move during the day, and a posted time marks when a host said something, not when the last server was done. Check the source link before you rely on a row. ## How fast each host said "patched" This chart counts hours from the PHP release to each host's first statement that sites were patched. It isn't a ranking of how well the hosts protect you. Several hosts had mitigations running earlier, and "patched" covers different scopes at each one. ```bars {"title": "Hours from PHP release to first \"patched\" statement", "note": "From about 14:00 UTC on October 21 to: GoDaddy Managed WordPress, Pantheon live sites on 8.2 to 8.5, Cloudways Autonomous, GoDaddy Windows Hosting, and DreamHost's \"large portion\" of servers. Status-page times, not actual patch times.", "data": [ {"label": "GoDaddy WP", "value": 5.5, "display": "5.5h"}, {"label": "Pantheon", "value": 5.8, "display": "5.8h"}, {"label": "Cloudways", "value": 11, "display": "11h"}, {"label": "GoDaddy Windows", "value": 11.3, "display": "11.3h"}, {"label": "DreamHost", "value": 16, "display": "16h"} ]} ``` ## Host-by-host status The table lists what each host has stated publicly. "None" in the last column means the host says it is handling the update for you. | Host | Status | What you need to do | Source | |---|---|---|---| | GoDaddy | Managed WordPress patched on all PHP versions. Web Hosting deploying vendor patches. | Nothing, except on VPS, where you update yourself. | [GoDaddy](https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do) | | Pantheon | Live sites, long-term support versions and all pre-production environments patched. Monitoring. | Nothing. | [Status page](https://status.pantheon.io/incidents/x7h8z1yhgvml) | | DreamHost | Official PHP fixes deployed. Final checks on the remaining server groups. 8.1 and older covered by mitigations. | Nothing. | [Status page](https://www.dreamhoststatus.com/pages/incident/575f0f606826303142000510/6ad8c218a7031204d4ca2981) | | Cloudways | Rollout complete: all active servers updated. | Nothing. | [Status page](https://status.cloudways.com/) | | Liquid Web | Deploying patched PHP builds across its hosting. | cPanel/WHM customers can patch 8.2 to 8.5 themselves now. | [Status page](https://status.liquidweb.com/incidents/6bfpxwg75xgj) | | Namecheap | Fix on all but about ten named servers, mitigations on the rest. | VPS and dedicated: update PHP now. | [Namecheap](https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/) | | Kinsta | Resolved: PHP security updates rolled out across the platform. | Nothing. | [Status page](https://status.kinsta.com/) | | SiteGround | Affected functions disabled on all supported PHP versions. | Nothing. | [SiteGround](https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026) | | Hostinger | Fix installed on all hosting servers except VPS. | VPS: update PHP yourself. | [Hostinger](https://www.hostinger.com/blog/protecting-php2shell/) | | Bluehost | Majority of servers patched, remaining ones in progress, mitigations in place. | Nothing. | [Status page](https://www.bluehost.com/status/announcement/271) | | UnderHost | Shared and managed servers patched. | Unmanaged VPS and dedicated: patch yourself. | [UnderHost](https://underhost.com/blog/php-security-release-october-2026-patch-guide/) | A few notes on specific rows: - **GoDaddy** posted three statuses. Managed WordPress at 19:30 UTC on October 21, Windows Hosting later, and Web Hosting still deploying vendor patches at 01:20 UTC on October 22. - **Pantheon** reported its 8.1 and older production sites patched at 17:16 PDT on October 21, and all pre-production environments at 19:08 PDT. - **DreamHost** said at 10:59 PM PDT on October 21 that the official fixes were deployed, and at 4:24 AM PDT on October 22 that it was running final checks on the remaining server groups. - **Cloudways** named PHP 5.6 to 8.4 in its 22:19 UTC patched list. It didn't list 8.5, and old versions are covered through extended-support partners. It called the rollout complete at 10:20 UTC on October 22 and is contacting a small group of customers who need extra help. - **Kinsta** marked its status-page incident resolved at 08:26 UTC on October 22: "All sites are protected." It kept its Cloudflare firewall rules in place and said it saw no evidence of breaches tied to the flaw. - **SiteGround** published its note at 11:30 UTC, before the fix existed, and doesn't state patch versions. That's a mitigation, not a patched version number. - **Hostinger** finished its rollout at 06:44 UTC on October 22. VPS plans are the exception, so the update is yours there. - **Bluehost** posted its last update at 23:00 EST on October 21. The notice is titled "PHP Updates" and doesn't name the CVEs, so confirm with support if you're unsure it covers PHP2Shell. - **Namecheap** listed the servers still pending at 10:27 UTC on October 22: resellers 48 and 55, and regular servers 71, 72, 86, 105, 165, 310, 312 and 320. InMotion has a status notice on PHP configuration updates, but we couldn't read its details. We found no public statement from WP Engine. That doesn't mean either has done nothing. Open a ticket and ask them directly, using the questions at the end of the next section. > [!KEY] > "Mitigated" and "patched" aren't the same state. A mitigation switches off one code path. Only the fixed PHP version closes the flaw. ## Who still has to act ### Managed WordPress hosting Pantheon, Cloudways, Kinsta and GoDaddy Managed WordPress all say the work is theirs, and Cloudways and Kinsta now call it done. Your job is to confirm it. Look at the patch level (the next section covers how) and watch the host's status page until it closes the incident. If you manage client sites on a managed plan, save the status-page link in your ticket notes so you can answer a client's question in one reply. ### Shared hosting Shared plans sit in the middle. UnderHost and Hostinger say their shared servers are patched. GoDaddy Web Hosting, Bluehost and a few Namecheap servers were still being fixed at our last check. You can't patch PHP yourself on shared hosting, so check the version your site reports and ask support for a date if it's behind. ### VPS and dedicated servers On a server you control, the host won't touch your PHP. Namecheap's notice says "please update PHP now" for VPS and dedicated plans, and GoDaddy and UnderHost say the same about self-managed servers. First see what you run: ```bash php -v php -r 'echo PHP_VERSION, "\n";' ``` The command line version can differ from the one that serves web requests, so use Site Health for the final answer. Then update through your package manager. On Debian or Ubuntu: ```bash sudo apt update sudo apt upgrade ``` On RHEL-family systems: ```bash sudo dnf upgrade ``` On cPanel servers, EasyApache 4 version 25.91 shipped on October 21 with updated ea-php82 to ea-php85 packages and the fix backported to ea-php74, ea-php80 and ea-php81. Liquid Web's guidance for cPanel customers is to run the cPanel update and then a package update: ```bash sudo /scripts/upcp sudo yum update ``` Restart PHP-FPM or Apache afterwards so every worker picks up the new binary. If you can't update right away, php.net describes a stopgap: set `session.upload_progress.enabled=0` and restart every worker. It says that blocks the confirmed session paths but not other variants, and that only an update is a complete solution. ### Cloudflare in front does not replace patching Cloudflare turned on default WAF protection for free and paid plans at 03:02 UTC on October 21, about 11 hours before disclosure. That's real protection, and Pro, Business and Enterprise customers should confirm their Managed Ruleset is in block mode. > [!WARNING] > A WAF is not a patch. Cloudflare's own advice is that customers should still patch PHP "even with WAF protections". Anything that reaches your origin without passing through the proxy skips the rules. ### Questions to put to your host If your host isn't in the table, or you're not sure, ask these: - Which PHP versions on my plan have the October 21 fixes, and when did they go live? - Is my plan patched, or only mitigated? - What's the plan for PHP 8.1 and older sites? - Did every PHP-FPM worker restart after the update, so no server is still running the old binary? ## How to check your own host Don't guess from a status page. Ask the server. In your dashboard, go to **Tools > Site Health**, open the **Info** tab and expand **Server**. The PHP version line shows what your site runs. Compare it with the fixed releases: | Branch | Fixed in | |---|---| | PHP 8.5 | 8.5.12 | | PHP 8.4 | 8.4.27 | | PHP 8.3 | 8.3.36 | | PHP 8.2 | 8.2.35 | If your number is lower, you aren't patched upstream. One catch: some hosts and Linux distributions backport fixes without changing the version string, so a lower number isn't always proof of exposure. Before you panic or open a ticket, check the package changelog. ### Lower number? Read the package changelog The changelog is the one place that says whether the fix is in. On a VPS or dedicated server, run the line that matches your setup as root: ```bash # cPanel and CloudLinux (EasyApache PHP) rpm -q --changelog ea-php83-php-common | head -5 # AlmaLinux, Rocky or RHEL (distro or Remi PHP) rpm -q --changelog php-common | head -5 # Ubuntu or Debian zcat /usr/share/doc/php8.3-common/changelog.Debian.gz | grep -m3 109618 ``` Swap `83` or `8.3` for your branch. If the output names CVE-2026-109618 or CVE-2026-109619, you're patched, whatever the version string says. CloudLinux is a real example. Its EasyApache builds dated October 21 still report PHP 8.3.35 and 8.4.26, below the fixed releases, yet their changelogs list both CVEs. The build to look for ends in `8.3.35-2.cloudlinux.2` or `8.4.26-2.cloudlinux.1`. On a managed server your host installs these for you, and the changelog lets you confirm it without waiting on a busy support queue. One last step on any server you patch yourself: restart PHP. LiteSpeed servers need `systemctl restart lsws`, and PHP-FPM servers need the FPM service restarted, or the old code keeps running in memory. PHP 8.1 and older receive no updates from the PHP project. Minimal source backports exist for 7.4, 8.0 and 8.1, and hosts that ship them (Pantheon's long-term support versions, Cloudways through its partners, Liquid Web's 8.1.34-5 build) are covering you in a vendor-specific way. If your host isn't doing that, move to a supported branch. Our guide to [changing the PHP version on any host](/blog/wordpress-php-version) walks through the steps, and [the latest PHP version for WordPress](/blog/latest-php-version-wordpress) explains which branch to pick. ## Is anyone being attacked? The reports disagree, and we're not going to reconcile them. Qualys said on October 21 that active exploitation attempts targeting PHP2Shell have been observed in the wild, citing reports from Amazon Threat Intelligence, Cloudflare and Patchstack hosting partners. Cloudflare said it observed attack traffic targeting its customers, without giving a time. Pantheon saw something milder. It blocked more than 60,000 suspicious probing requests and said at 12:30 PDT it had no evidence of widespread exploitation attempts or any successful exploits. DreamHost said at 6:46 AM PDT it hadn't observed any attack traffic. Those statements were made at different times, on different networks, and the picture can change quickly. ## Check your site Not sure what your server announces? Our free scan at [wpvanguard.com](/#scanner) reports the PHP version your site exposes and flags when it's missing security fixes. If you look after client sites, run it across your whole list today, then use the table above to chase the hosts that haven't finished. ## References - [PHP project release archive for 2026](https://www.php.net/archive/2026.php) - [GoDaddy: important PHP security update](https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do) - [Pantheon status incident](https://status.pantheon.io/incidents/x7h8z1yhgvml) - [DreamHost status incident](https://www.dreamhoststatus.com/pages/incident/575f0f606826303142000510/6ad8c218a7031204d4ca2981) - [Cloudways status](https://status.cloudways.com/) - [Liquid Web status incident](https://status.liquidweb.com/incidents/6bfpxwg75xgj) - [Namecheap status update](https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/) - [Kinsta status page](https://status.kinsta.com/) - [Hostinger: protections against PHP2Shell](https://www.hostinger.com/blog/protecting-php2shell/) - [Bluehost status: PHP Updates](https://www.bluehost.com/status/announcement/271) - [SiteGround blog post](https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026) - [UnderHost patch guide](https://underhost.com/blog/php-security-release-october-2026-patch-guide/) - [cPanel EasyApache 4 changelog](https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/) - [Cloudflare: PHP vulnerabilities and WAF protection](https://blog.cloudflare.com/php-vulnerabilities-waf-protection/) - [Qualys: PHP critical security release](https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities)