PHP2Shell host patch status: who has patched, who hasn't said
October 22, 2026
5
mins read
This page tracks what hosting providers and platforms have published about the PHP2Shell patches (CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026). It records what each host said, when, which PHP builds, which plans were left out, and the source. It does not test any server.
Last checked: 28 October 2026, 8:46 PM IST. We re-check twice a day this week and keep a changelog at the end. Background, the five questions to ask your host and the version checker are in our guide PHP2Shell: what WordPress site owners should check today.
How to read the table
- Patched: the host says fixed PHP builds are deployed. Patched (partly, see note): deployed on some plans or versions; the note says which. Patching: rollout under way at the host's last update.
- Protected (host's word): the host uses "protected" and does not name a build. Mitigation only: a firewall rule or disabled function, not yet a patched build.
- Self-managed: cloud or VPS plans where you update PHP yourself. No statement found: we could not find anything public as of the last check; it does not mean the host has done nothing.
- Times are UTC, taken from the host's own status page or post. "Secondary" in a note means we could only reach a report about the host, not the host's own page. Quotes are the host's words.
Host status table
| Host | Status, note and what they said | Last update | Source |
|---|---|---|---|
| WP Engine global | Patched patched (WP Engine status incident resolved; confirmed on own status page) Older PHP: updated builds listed 7.4.33.17, 8.2.35, 8.4.27, 8.5.12 “WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on our platform.” | 2026-10-22 01:19 UTC | wpenginestatus.com |
| Flywheel global | Patched patched; 23 Oct: says existing mitigations already cover the new CVE-2026-115560 (update time shown without a timezone, read as CDT) Older PHP: not stated “WP Engine Security has reviewed the new vulnerability affecting PHP noted in CVE-2026-115560 and existing site-level mitigations already protect customers against exploitation.” | 2026-10-23 15:00 UTC | status.getflywheel.com |
| Kinsta global | Patched patched (status incident Resolved; Cloudflare WAF rules stay in place) Older PHP: patched builds for 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 and 8.5 “the PHP security updates have been rolled out across the platform” | 2026-10-22 08:26 UTC | status.kinsta.com, community.kinsta.com |
| SiteGround global | Patched patched (official PHP fixes applied on all servers after earlier mitigations) Older PHP: all supported PHP versions (no branches listed) “PHP has released the fixes, and they’re now applied across all SiteGround servers.” | 2026-10-22 12:00 UTC | siteground.com |
| Cloudways global | Patched patched (Autonomous and Flexible; incident moved from monitoring to Resolved on 23 Oct) Older PHP: all supported versions, including deprecated ones “The PHP security patch rollout is complete, and all active servers have been successfully updated.” | 2026-10-23 12:38 UTC | status.cloudways.com, digitalocean.com |
| Hostinger global (incl. India; no India-specific note) | Patched (partly, see note) patched (non-VPS); 23 Oct: non-VPS plans already protected against the new CVE-2026-115560; VPS users told to set session.upload_progress.enabled = Off and restart PHP Older PHP: 5.2-8.5 patched builds “Every Hostinger hosting plan except VPS is already fully protected by the changes we made on October 21” | 2026-10-23 13:25 UTC | hostinger.com, statuspage.hostinger.com |
| GoDaddy global (no India note) | Patched (partly, see note) patched (Managed WP, Windows, Web Hosting) / self (VPS; patched ea-php via EasyApache 4); Web Hosting: check build date is 21 Oct or later; 23 Oct: new CVE-2026-115560 not yet patched, session.upload_progress.enabled = 0 already set on managed servers, VPS users set it in php.ini and restart PHP Older PHP: no official fix for 8.1 and older; cPanel backports for 7.4, 8.0, 8.1; move to 8.2+ “PHP has disclosed a separate vulnerability, CVE-2026-115560, which is not yet patched.” | 2026-10-23 21:00 UTC | godaddy.com |
| Bluehost global (no India note) | Patching patching (majority of platforms up to date; self-managed VPS/dedicated run package updates and watch for emails; updates posted 23 Oct, 12:35 and 20:55 "est"; latest says the new CVE-2026-115560 is covered by existing protections, no action for managed hosting) Older PHP: patched builds listed for cPanel 7.4-8.5, Plesk 8.2-8.5, CloudLinux alt-php back to 5.2 “Our teams continue to work on deploying patched PHP builds across our remaining hosting infrastructure.” | 2026-10-24 | bluehost.com |
| HostGator global / India | Patching patching (same notice as Bluehost; majority of platforms up to date; VPS/dedicated run package updates; updates posted 23 Oct, 12:35 and 20:55 "est"; latest says the new CVE-2026-115560 is covered by existing protections; no India note) Older PHP: patched builds listed back to 5.2.17 “The majority of these platforms are now up-to-date.” | 2026-10-24 | hostgator.com |
| DreamHost global | Patched patched (fix installed on all servers incl. Shared, Dedicated, VPS and DreamPress; incident moved from monitoring to Resolved on 23 Oct) Older PHP: 8.1 and older covered under DreamHost's PHP Extended Support program “PHP's security fix is now installed across all DreamHost servers, including Shared, Dedicated, VPS, and DreamPress.” | 2026-10-23 18:26 UTC | dreamhoststatus.com |
| Pantheon global | Patched (partly, see note) patched (incident closed; live and pre-production done incl. LTS); free/sandbox completion not confirmed Older PHP: LTS 8.1.x-5.6.x included in completed rollout “Our rollout of updated PHP images across customer environments including LTS versions was complete as of 5pm Pacific time yesterday.” | 2026-10-22 16:36 UTC | status.pantheon.io |
| Pressable global | Protected (host's word) protected (all versions) Older PHP: all offered versions protected “Every PHP version available on Pressable is protected.” | 2026-10-21 07:00 UTC | pressablestatus.com |
| WordPress.com / WordPress VIP / WP Cloud global | Protected (host's word) protected (no build named; 'patched' not used) “there's nothing you need to do to keep your site safe” | 2026-10-21 | automattic.com, wordpress.com |
| Liquid Web global | Patching patching (rollout in stages; incident open; latest update 28 Oct 10:57 EDT says it is continuing to monitor patch deployment across its hosting fleets, no completion statement; earlier updates list fixed builds for cPanel, CloudLinux, Plesk, Windows Plesk, InterWorx and Remi) Older PHP: CloudLinux 5.2-8.5; cPanel backports 8.1, 8.0, 7.4; Plesk marks 7.4-8.1 end-of-life “We are continuing to monitor patch deployment across our hosting fleets.” | 2026-10-28 14:57 UTC | status.liquidweb.com |
| Nexcess global | Patching patching (status incident open; fixed builds listed 22 Oct 14:42 UTC; latest update 28 Oct 10:56 EDT says it is continuing to monitor patch deployment across its hosting fleets and points to a help article on checking the running PHP version, no completion statement) Older PHP: fixed builds listed for 8.x, 7.x and 5.x back to 5.2.17 “We are continuing to monitor patch deployment across our hosting fleets.” | 2026-10-28 14:56 UTC | status.nexcess.net |
| Rocket.net global | Patching patching (rolling waves; incident marked Resolved at 10:36 UTC without a completion statement) Older PHP: 5.2-8.5 receiving patches; 8.2+ recommended “being deployed across the fleet in rolling waves” | 2026-10-22 10:36 UTC | status.rocket.net |
| A2 Hosting global (now hosting.com) | Patched (partly, see note) patched (cPanel/Plesk shared and managed; Enhance from 7.4) / self (self-managed VPS); incident Resolved 22 Oct 17:02 "CST" Older PHP: all versions from 5.2 on cPanel/Plesk; 8.3 and older urged to move to 8.4+ “The PHP-related service update has been completed successfully.” | 2026-10-22 | status.hosting.com |
| Namecheap global | Patched patched (maintenance finished on remaining servers); later update, stamped "7:00 PM EDT | 00:00 UTC" with no date: CloudLinux packages now carry correct version numbers, shared servers show 8.5.12, 8.4.27, 8.3.36, 8.2.35 Older PHP: 5.2-8.1 fixed but keep their old version numbers “All PHP versions offered on our Shared Hosting servers are patched against these vulnerabilities.” | undated (after 2026-10-22 16:50 UTC) | namecheap.com |
| InMotion Hosting global | Patched (partly, see note) patched (dedicated) / patching (VPS) / mitigated (shared) per secondary Older PHP: 5.2-8.5 shared; 7.4-8.5 VPS/dedicated; 7.3 and older no fix (secondary) “dedicated servers are done, VPS in progress, shared hosting protected while waiting for the patch. (Meow Apps, secondary)” | 2026-10-21 14:40 UTC | status.inmotionhosting.com, inmotionhosting.com |
| Hetzner EU | Patched (partly, see note) patched (Webhosting + Managed: 7.4, 8.0-8.5 on 21 Oct; 5.6, 7.3 on 22 Oct) Older PHP: 5.6 and 7.3 patched 22 Oct “We deployed patches for the remaining PHP versions 5.6 and 7.3 on all Webhosting- and Managed-Servers.” | 2026-10-22 04:32 UTC | status.hetzner.com |
| OVHcloud EU | Patched patched (7.4-8.5, all clusters, 21 Oct; 5.3-7.3 deployment completed 23 Oct); scheduled maintenance marked completed 26 Oct 09:50 UTC, ahead of the 18:00 UTC end time Older PHP: 5.3-7.3 patch deployment completed 23 Oct 17:07 UTC “The scheduled maintenance has been completed.” | 2026-10-26 09:50 UTC | web-cloud.status-ovhcloud.com |
| DigitalOcean (Droplets / App Platform / 1-Click) global | Self-managed: update it yourself self (Droplets, existing 1-Click) / patched buildpack (App Platform, redeploy) “Instances you already deployed don't update themselves.” | 2026-10-21 | digitalocean.com |
| AWS (Lightsail / EC2 / Elastic Beanstalk / Amazon Linux) global | Self-managed: update it yourself self (Lightsail: updated blueprints in all regions, rebuild running instances; EC2; Lambda) / patched platform (EB 8.2-8.5, auto only with managed updates) / packages (AL); WorkMail upgraded by AWS to 8.3.36; bulletin re-dated 23 Oct, no change log Older PHP: 5.4-8.1 no upstream fix; migrate to a supported branch “AWS cannot update running Lightsail instances in place.” | 2026-10-23 20:30 UTC | aws.amazon.com |
| Google Cloud (App Engine / Cloud Run / Functions) global | Patched (partly, see note) patched (App Engine standard 8.2+; Cloud Run and functions 8.2+ only with automatic base image updates) / self-redeploy (flexible, GKE, custom images); 23 Oct: post updated with Mandiant guidance on monitoring, patching and remediation Older PHP: 5.5, 7.2, 7.3, 7.4 and 8.1 remain vulnerable; upgrade to 8.2+ “App Engine standard environment (PHP 8.2 and newer): Applications are updated automatically. No action is required.” | 2026-10-23 22:20 UTC | cloud.google.com |
| Microsoft Azure App Service global | Patched (partly, see note) patched (Linux built-in images, Latest and Standard channels; Extended last) / self (custom containers); old Alpine WordPress images not patched Older PHP: end-of-life versions get no patch “We have completed the rollout of the updated built-in PHP images with the security fixes” | 2026-10-21 | azure.github.io, learn.microsoft.com, techcommunity.microsoft.com |
| Vercel global | WAF rules; runtime is yours WAF rules (all projects); runtime self | 2026-10-21 | vercel.com |
| Netlify global | No statement found | — | — |
| Webflow global | Not affected not affected (core services not built on PHP); 23 Oct update also names the new CVE-2026-115560 and says non-production systems that may use PHP were assessed and mitigated “Webflow’s core services are not built on PHP and are not affected.” | 2026-10-23 21:23 UTC | trust.webflow.com |
| Hostinger India India | No regional statement the global post applies | — | hostinger.com |
| BigRock India | No statement found | — | — |
| HostGator India India | No statement found | — | — |
| GoDaddy India India | No regional statement the global post applies | — | godaddy.com |
| Bluehost India India | No statement found | — | — |
| MilesWeb India | No statement found | — | — |
| ResellerClub India | No statement found | — | — |
Control panels and operating systems
Many hosts depend on these packages rather than building PHP themselves. Ubuntu shipped fixes on 21 October (USN-8948-1, including php8.1 for 22.04). cPanel's EasyApache 4 carries 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with the fix backported into its 7.4, 8.0 and 8.1 packages without a version-number change, so on cPanel servers the build date matters more than the version string. The PHP security team itself published source-only backports for 7.4, 8.0 and 8.1.
What to do with this
- Find your host. If it says patched, confirm your plan is included (VPS, dedicated and legacy plans are often excluded) and ask whether PHP workers were restarted.
- If it says patching, mitigation only, or nothing at all, open a ticket today with the five questions in our PHP2Shell guide, and quote the host's own status page.
- If you are on a self-managed cloud plan, the update is yours to run: update the PHP package, restart PHP-FPM or the web server, and check the running version.
- Patch first. Then, if this week has made you wonder who should own the next runtime patch under your marketing site, our 3-day WordPress migration is one answer; staying on a well-run managed host is another.
Found a statement we missed, or a correction? Email rehan@activeset.co with the link and we will add it with credit.
Sources
Every row links to its source. Timeline and official advisories: PHP security advisory (21 Oct), PHP Foundation (21 Oct), CISA (21 Oct), CERT-In CIVN-2026-0510 (21 Oct), Ubuntu USN-8948-1 (21 Oct). Rows marked "secondary" rely on The Repository or Meow Apps because the host's own page could not be reached.
Changelog
- 28 October 2026, 8:46 PM IST: Liquid Web new update, continuing to monitor patch deployment, still Patching (14:57 UTC); Nexcess new update, same wording, still Patching (14:56 UTC). No host reports confirmed exploitation of customer sites; CERT-In CIVN-2026-0510 still shows "Last Updated On October 28, 2026", still says multiple reports confirm large-scale exploitation in the wild and lists only CVE-2026-109618 and CVE-2026-109619; CISA KEV still lists CVE-2026-109618 and CVE-2026-109619 (added 26 Oct, due 29 Oct) and does not list CVE-2026-115560; no new PHP Foundation or php.net items, and no PHP release fixes CVE-2026-115560 yet. Other hosts re-checked, no change; InMotion's support article returned 403 and its status page showed no incident content, and the WP Engine and SiteGround pages did not load, so those rows are unchanged; no first statements found for Netlify or the Indian hosts marked No statement found.
- 28 October 2026, 8:41 AM IST: Liquid Web new update, deployment progressing well, still Patching (18:27 UTC). Nexcess has posted nothing since 27 Oct 14:12 UTC, still Patching. No host reports confirmed exploitation of customer sites; CERT-In CIVN-2026-0510 now shows "Last Updated On October 28, 2026", still says multiple reports confirm large-scale exploitation in the wild and lists only CVE-2026-109618 and CVE-2026-109619; CISA KEV still lists CVE-2026-109618 and CVE-2026-109619 (added 26 Oct, due 29 Oct) and does not list CVE-2026-115560; no new PHP Foundation or php.net items, and no PHP release fixes CVE-2026-115560 yet. Other hosts re-checked, no change; InMotion's support article returned 403 and its status page showed no incident content, the WP Engine and SiteGround pages did not load, and the BigRock page returned 403, so those rows are unchanged; no first statements found for Netlify or the Indian hosts marked No statement found.
- 27 October 2026, 8:41 PM IST: Liquid Web new update, deployment progressing well, still Patching (14:13 UTC); Nexcess new update, same wording, still Patching (14:12 UTC). CISA KEV (catalog 2026.10.26, released 26 Oct 22:24 UTC) lists CVE-2026-109618 and CVE-2026-109619, both added 26 Oct with a due date of 29 Oct; this morning's entry wrongly said they were not listed; CVE-2026-115560 is not listed. No host reports confirmed exploitation of customer sites; CERT-In CIVN-2026-0510 still shows "Last Updated On October 27, 2026", still says multiple reports confirm large-scale exploitation in the wild and lists only CVE-2026-109618 and CVE-2026-109619; no new PHP Foundation or php.net items, and no PHP release fixes CVE-2026-115560 yet. Other hosts re-checked, no change; InMotion's support article returned 403 and its status page showed no incident content, so that row is unchanged; the BigRock, HostGator India and ResellerClub pages returned 403; no first statements found for Netlify or the Indian hosts marked No statement found.
- 27 October 2026, 8:41 AM IST: Re-checked all hosts; no changes. Liquid Web and Nexcess have posted nothing since 26 Oct 10:41 and 10:42 UTC, both still Patching. No host reports confirmed exploitation of customer sites; CERT-In CIVN-2026-0510 now shows "Last Updated On October 27, 2026", still says multiple reports confirm large-scale exploitation in the wild and lists only CVE-2026-109618 and CVE-2026-109619; CISA KEV (catalog 2026.10.26) does not list CVE-2026-109618, CVE-2026-109619 or CVE-2026-115560; no new PHP Foundation or php.net items, and no PHP release fixes CVE-2026-115560 yet. InMotion's support article returned 403 and its status page did not load, the SiteGround and WP Engine pages did not load, and the Namecheap post link showed only the status list, so those rows are unchanged; the BigRock page returned 403; no first statements found for Netlify or the Indian hosts marked No statement found.
- 26 October 2026, 8:50 PM IST: OVHcloud scheduled maintenance marked completed, to Patched (09:50 UTC); Liquid Web new update, deployment progressing well, fixed-build list now also covers InterWorx and Remi, still Patching (10:41 UTC); Nexcess new update, same wording, still Patching (10:42 UTC). No host reports confirmed exploitation of customer sites; news reports (secondary, SecurityWeek 26 Oct) describe working shells on a researcher's honeypots on 24 Oct, not on any named host; CERT-In CIVN-2026-0510 still shows "Last Updated On October 26, 2026" and lists only CVE-2026-109618 and CVE-2026-109619; CISA KEV (newest entries 2026-10-23) does not list CVE-2026-109618, CVE-2026-109619 or CVE-2026-115560; no new PHP Foundation items; php.net's only new item (26 Oct) is an unrelated Windows Brotli rebuild, and no PHP release fixes CVE-2026-115560 yet. Other hosts re-checked, no change; InMotion's support article returned 403, and the SiteGround and WP Engine pages did not load, so those rows are unchanged; no first statements found for Netlify or the Indian hosts marked No statement found.
- 26 October 2026, 8:41 AM IST: Re-checked all hosts; no changes. Liquid Web and Nexcess have posted nothing since 25 Oct 12:22 and 12:23 UTC, both still Patching; OVHcloud's maintenance window is still open to 26 Oct 18:00 UTC. No host reports confirmed exploitation of customer sites; CERT-In CIVN-2026-0510 now shows "Last Updated On October 26, 2026", still says multiple reports confirm large-scale exploitation in the wild and lists only CVE-2026-109618 and CVE-2026-109619; CISA KEV (catalog 2026.10.23) does not list CVE-2026-109618, CVE-2026-109619 or CVE-2026-115560; no new PHP Foundation or php.net items, and no PHP release fixes CVE-2026-115560 yet. InMotion's support article returned 403 and its status page did not load, and the SiteGround and WP Engine pages did not load, so those rows are unchanged; the BigRock, HostGator India and ResellerClub pages returned 403; no first statements found for Netlify or the Indian hosts marked No statement found.
- 25 October 2026, 8:45 PM IST: Liquid Web new update, deployment progressing well, still Patching (12:22 UTC); Nexcess new update, same wording, still Patching (12:23 UTC). No host reports confirmed exploitation of customer sites; CERT-In CIVN-2026-0510 still shows "Last Updated On October 25, 2026", still says multiple reports confirm large-scale exploitation in the wild and lists only CVE-2026-109618 and CVE-2026-109619; CISA KEV (newest entries 2026-10-23) does not list CVE-2026-109618, CVE-2026-109619 or CVE-2026-115560; no new PHP Foundation or php.net items, and no PHP release fixes CVE-2026-115560 yet. Other hosts re-checked, no change; InMotion's support article returned 403 and its status page did not load, and the SiteGround and WP Engine pages did not load, so those rows are unchanged; no first statements found for Netlify or the Indian hosts marked No statement found.
- 25 October 2026, 8:42 AM IST: Liquid Web new update, deployment under way with good progress, still Patching (24 Oct 21:55 UTC); Nexcess new update, same wording, still Patching (24 Oct 21:54 UTC). No host reports confirmed exploitation of customer sites; CERT-In CIVN-2026-0510 now shows "Last Updated On October 25, 2026" (no time given), still says multiple reports confirm large-scale exploitation in the wild and still lists only CVE-2026-109618 and CVE-2026-109619; CISA KEV (catalog 2026.10.23) does not list CVE-2026-109618, CVE-2026-109619 or CVE-2026-115560; no new PHP Foundation or php.net items, and no PHP release fixes CVE-2026-115560 yet. Other hosts re-checked, no change; InMotion's support article and the BigRock, HostGator India and ResellerClub pages returned 403.
- 24 October 2026, 8:43 PM IST: Liquid Web new update, deployment continues, still Patching (11:37 UTC); Nexcess new update, deployment continues, still Patching (11:37 UTC); Webflow's 23 Oct update now also names the new CVE-2026-115560, still Not affected (21:23 UTC). No host reports confirmed exploitation of customer sites; CERT-In updated CIVN-2026-0510 on 24 Oct (it says multiple reports confirm large-scale exploitation in the wild) and added CICA-2026-3650, neither listing CVE-2026-115560; CISA KEV (catalog 2026.10.23) does not list CVE-2026-109618, CVE-2026-109619 or CVE-2026-115560; no new PHP Foundation or php.net items, and no PHP release fixes CVE-2026-115560 yet. Other hosts re-checked, no change; InMotion's support article and the BigRock, HostGator India, MilesWeb and ResellerClub pages returned 403.
- 24 October 2026, 8:42 AM IST: DreamHost incident moved from monitoring to Resolved, fix installed on all servers incl. VPS and DreamPress, still Patched (18:26 UTC); GoDaddy new note on CVE-2026-115560, mitigation already set on managed servers, VPS users to set it themselves, still Patched (partly) (21:00 UTC); Bluehost and HostGator new updates (23 Oct, 12:35 and 20:55 "est"), say CVE-2026-115560 is covered by existing protections, still Patching; Liquid Web new update, still Patching (24 Oct 02:25 UTC); Nexcess new update, still Patching (24 Oct 02:26 UTC); OVHcloud completed patch deployment for PHP 5.3-7.3, maintenance window still open, still Patched (partly) (17:07 UTC); AWS bulletin re-dated, WorkMail upgraded by AWS, still Self-managed (20:30 UTC); Google Cloud post updated with Mandiant guidance, status unchanged (22:20 UTC). No host reports confirmed exploitation of customer sites; news reports (secondary) describe widespread exploitation attempts; CISA KEV (catalog 2026.10.23) does not list CVE-2026-109618, CVE-2026-109619 or CVE-2026-115560; no new PHP Foundation or php.net items. Other hosts re-checked, no change; InMotion's pages could not be fetched (403), and BigRock and ResellerClub pages returned 403 again.
- 23 October 2026, 8:43 PM IST: Flywheel new update, says existing mitigations already cover the new CVE-2026-115560, still Patched (23 Oct 10:00 am, read as CDT, 15:00 UTC); Hostinger update on CVE-2026-115560, non-VPS plans already protected and VPS users told to disable session upload progress, still Patched (partly) (13:25 UTC); Cloudways incident moved from monitoring to Resolved, still Patched (12:38 UTC); Liquid Web new update, still Patching (08:35 UTC); Nexcess new update, still Patching (08:33 UTC); Namecheap undated update: CloudLinux packages now show the fixed version numbers on shared servers, still Patched. php.net posted an informational advisory on 23 Oct recommending session.upload_progress.enabled=0 until the next regular release (new CVE-2026-115560, linked to the CVE-2026-109619 advisory). No host reports confirmed exploitation (Pantheon and DreamHost report blocked probing; Hostinger says attempts were blocked); CISA KEV does not list either CVE; no new PHP Foundation items. Other hosts re-checked, no change; InMotion, BigRock, HostGator India, MilesWeb and ResellerClub pages could not be fetched (403).
- 23 October 2026, 8:45 AM IST: SiteGround to Patched (official fixes on all servers, 12:00 UTC); DreamHost to Patched (whole network, 18:12 UTC); Namecheap to Patched (maintenance finished, 16:50 UTC); WP Engine to Patched, now sourced from its own status page (01:19 UTC); A2 Hosting first statement found on status.hosting.com, Patched except self-managed VPS (Resolved 22 Oct); Nexcess first statement found, Patching (19:28 UTC); HostGator first statement found, Patching (22 Oct, 18:15 "est"); Pantheon incident closed, sandbox completion still unconfirmed (16:36 UTC); Liquid Web new update, still Patching (19:28 UTC); Bluehost new update, still Patching; GoDaddy new Web Hosting note on build dates (17:15 UTC); AWS bulletin updated, Lightsail blueprints in all regions (21:00 UTC); Google Cloud guidance updated, status unchanged (23:07 UTC). No host reports confirmed exploitation (Pantheon reports blocked probing); CISA KEV does not list either CVE; no new PHP Foundation or php.net items. Other hosts re-checked, no change; InMotion and most Indian hosts' own pages could not be fetched (403).
- 22 October 2026, 8:43 PM IST: Kinsta to Patched (status incident resolved 08:26 UTC); Cloudways to Patched (Flexible done, 10:20 UTC); GoDaddy Web Hosting now patched (13:30 UTC), VPS still self-managed; Bluehost new progress update, still Patching; DreamHost final staging tests on remaining groups (11:24 UTC); Liquid Web revised patched-build lists (14:33 UTC); Rocket.net incident marked Resolved without a completion statement, kept as Patching; Namecheap down to four servers (13:33 UTC); OVHcloud maintenance extended to 26 Oct for pre-7.4 versions (14:12 UTC); Azure App Service now cites Microsoft's own App Service post. No host reports exploitation; CISA KEV does not list either CVE. Other hosts re-checked, no change.
- 22 October 2026, 8:30 PM IST: First published with 35 hosts and platforms, checked during 22 October.
Work with ActiveSet
Want this done on your site?
We're a Webflow Premium Partner with 100+ Webflow projects. Book a free 30-minute call to talk through scope and timeline, and we'll follow up with a written quote.
FAQ’s
Frequently Asked Questions
(01)
My host says "protected". Is that the same as patched?
Not necessarily. "Protected" can mean the fixed PHP build is deployed, or that a firewall rule or disabled function is blocking the known attack while the build is still rolling out. Ask which PHP build serves your plan and whether its workers were restarted.
(02)
My host isn't in the table. What do I do?
Open a ticket with the five questions in our PHP2Shell guide, and send us the host's statement if you find one; we'll add it. Hosts that resell cPanel or Plesk usually depend on those vendors' packages, which shipped on 21 October.
(03)
Does this table tell me my own site is patched?
No. It tells you what the host has said publicly. Many statements exclude VPS, dedicated or legacy plans, and a long-running PHP worker can keep old code until it is restarted. Confirm your own plan with the host.
(04)
(05)
