PHP2Shell host patch status: who has patched, who hasn't said (updated 22 Oct 2026)

This page tracks what hosting providers and platforms have published about the PHP2Shell patches (CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026). It records what each host said, when, which PHP builds, which plans were left out, and the source. It does not test any server.

Last checked: 22 October 2026, 8:43 PM IST. We re-check twice a day this week and keep a changelog at the end. Background, the five questions to ask your host and the version checker are in our guide PHP2Shell: what WordPress site owners should check today.

How to read the table

• Patched: the host says fixed PHP builds are deployed. Patched (partly, see note): deployed on some plans or versions; the note says which. Patching: rollout under way at the host's last update.
• Protected (host's word): the host uses "protected" and does not name a build. Mitigation only: a firewall rule or disabled function, not yet a patched build.
• Self-managed: cloud or VPS plans where you update PHP yourself. No statement found: we could not find anything public as of the last check; it does not mean the host has done nothing.
• Times are UTC, taken from the host's own status page or post. "Secondary" in a note means we could only reach a report about the host, not the host's own page. Quotes are the host's words.

Host status table

Control panels and operating systems

Many hosts depend on these packages rather than building PHP themselves. Ubuntu shipped fixes on 21 October (USN-8948-1, including php8.1 for 22.04). cPanel's EasyApache 4 carries 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with the fix backported into its 7.4, 8.0 and 8.1 packages without a version-number change, so on cPanel servers the build date matters more than the version string. The PHP security team itself published source-only backports for 7.4, 8.0 and 8.1.

What to do with this

1. Find your host. If it says patched, confirm your plan is included (VPS, dedicated and legacy plans are often excluded) and ask whether PHP workers were restarted.
2. If it says patching, mitigation only, or nothing at all, open a ticket today with the five questions in our PHP2Shell guide, and quote the host's own status page.
3. If you are on a self-managed cloud plan, the update is yours to run: update the PHP package, restart PHP-FPM or the web server, and check the running version.
4. Patch first. Then, if this week has made you wonder who should own the next runtime patch under your marketing site, our 3-day WordPress migration is one answer; staying on a well-run managed host is another.

Found a statement we missed, or a correction? Email rehan@activeset.co with the link and we will add it with credit.

Sources

Every row links to its source. Timeline and official advisories: PHP security advisory (21 Oct), PHP Foundation (21 Oct), CISA (21 Oct), CERT-In CIVN-2026-0510 (21 Oct), Ubuntu USN-8948-1 (21 Oct). Rows marked "secondary" rely on The Repository or Meow Apps because the host's own page could not be reached.

Changelog

• 22 October 2026, 8:43 PM IST: Kinsta to Patched (status incident resolved 08:26 UTC); Cloudways to Patched (Flexible done, 10:20 UTC); GoDaddy Web Hosting now patched (13:30 UTC), VPS still self-managed; Bluehost new progress update, still Patching; DreamHost final staging tests on remaining groups (11:24 UTC); Liquid Web revised patched-build lists (14:33 UTC); Rocket.net incident marked Resolved without a completion statement, kept as Patching; Namecheap down to four servers (13:33 UTC); OVHcloud maintenance extended to 26 Oct for pre-7.4 versions (14:12 UTC); Azure App Service now cites Microsoft's own App Service post. No host reports exploitation; CISA KEV does not list either CVE. Other hosts re-checked, no change.
• 22 October 2026, 8:30 PM IST: First published with 35 hosts and platforms, checked during 22 October.