---
title: "Which Hosts Have Patched PHP2SHELL (CVE-2026-109618) | Digital Hosting"
url: https://digitalhosting.com/php2shell-host-status
description: "A live tracker of how web hosts, WordPress hosts, and cloud providers have responded to the PHP2SHELL RCE. Statuses are self-reported; no server was tested."
lang: en
---

PHP2SHELL study

# Which hosts have patched PHP2SHELL

PHP2SHELL (CVE-2026-109618 and CVE-2026-109619) is a critical RCE in PHP, fixed on 21 October 2026. If a hosting company runs PHP for you, its response decides whether your site is protected. We track what the major hosts have said and update as it changes.

**How to read this.** Statuses come from each provider's own public statements, collected on 22 October 2026. We have not tested any servers. A "no statement found" row means we found nothing public, not that the host is unpatched. Statuses change hourly, so check the provider's status page before you act. For what the flaw is and how to patch a server you manage, see our PHP2SHELL explainer (https://digitalhosting.com/php2shell).

## What the statuses mean

Patched

The host says a fixed PHP build is deployed across the relevant plans.

Patching

A rollout is announced and under way.

Partial

Some plans are done and others are pending or left to the customer.

Mitigation only

A firewall rule or similar is in place, but no patched build is confirmed.

No statement found

We found nothing public as of the snapshot. This is not evidence of being unpatched.

## Managed web and WordPress hosts

| Provider | Type | Status | Reported (22 Oct 2026) |
| --- | --- | --- | --- |
| Kinsta | WordPress | Patched | 08:26 UTC, status incident |
| Flywheel | WordPress | Patched | 21 Oct 19:00 UTC, status page |
| Cloudways | Managed cloud | Patched | 10:20 UTC, status page |
| Pressable | WordPress | Patched host's wording, no build named | 21 Oct, status post |
| WordPress.com / VIP / WP Cloud | WordPress | Patched host's wording, no build named | 21 Oct, Automattic posts |
| WP Engine | WordPress | Partial sourced secondarily | 01:19 UTC |
| Hostinger | Web | Partial non-VPS patched | 07:20 UTC, blog |
| GoDaddy | Web | Partial Web Hosting patched; VPS self-managed | 13:30 UTC, news post |
| InMotion | Web | Partial shared mitigated | 21 Oct 14:40 UTC, status page |
| Pantheon | Platform | Partial sandbox pending | 02:08 UTC, status incident |
| Hetzner | Managed / EU | Partial older branches added later | 04:32 UTC, status incident |
| OVHcloud | Web / cloud / EU | Partial pre-7.4 still in progress | 14:12 UTC, status incident |
| SiteGround | Web | Mitigation only | 21 Oct 11:30 UTC, blog |
| Bluehost | Web | Patching | 22 Oct, announcement |
| DreamHost | Web | Patching final staging tests | 11:24 UTC, status incident |
| Liquid Web | Web | Patching | 14:33 UTC, status incident |
| Namecheap | Web | Patching a few servers left | 13:33 UTC, status update |
| Rocket.net | WordPress | Patching | 10:36 UTC, status incident |
| HostGator | Web | No statement found | — |
| Nexcess | Web | No statement found | — |
| A2 Hosting | Web | No statement found | — |

## Cloud and platform providers

On raw compute, the provider patches its own managed runtimes and you patch anything you run yourself. That split is the normal design, so read "you patch" as a division of labour, not a gap.

| Provider | What they patch | What you patch |
| --- | --- | --- |
| AWS | Elastic Beanstalk managed platform | Lightsail, EC2, your own Amazon Linux instances |
| Google Cloud | App Engine standard environment | Cloud Run, Cloud Functions, instances you redeploy |
| Microsoft Azure | Built-in Linux App Service images | Custom container images |
| DigitalOcean | App Platform (via redeploy) | Droplets, 1-Click PHP images |
| Vercel | WAF rules only | Your PHP runtime |
| Webflow | States it is not affected | — |
| Netlify | No statement found | — |

## Email hosts

The patch-status trackers list no dedicated email hosts, and for good reason. Mailbox providers such as Google Workspace, Microsoft 365, Zoho Mail, Fastmail, and Proton do not run your PHP. Their own web surfaces are theirs to patch, the same as any operator, but there is nothing for a mailbox customer to do about PHP2SHELL on that account. If you run a mail-adjacent PHP app, such as a webmail front end or a contact-form handler on your own hosting, that falls under your web hosting, not your mailbox provider.

## Control panels and operating systems

If your host uses a control panel, the PHP it serves is patched through that panel or the underlying distribution:

- **cPanel, Plesk, DirectAdmin:** check the panel's PHP package changelog for the CVE, or wait for the panel's updated builds.
- **CloudLinux:** ships hardened PHP builds and typically patches quickly through its own channel.
- **Debian, Ubuntu, RHEL and rebuilds:** the patch arrives as a package update that keeps the old version number. Debian 11 "bullseye" is a known gap, because its free support window closed, so a bullseye host on PHP 7.4 may have no free patch coming.

## What this means for you

- **On managed hosting:** find your host above, then confirm on its status page. If it is still "patching," your site may not be covered yet. Ask.
- **On unmanaged hosting or your own cloud instance:** this is yours to patch. See our explainer (https://digitalhosting.com/php2shell) for the steps.
- **If your host has no public statement:** that is not evidence either way. Open a ticket and ask whether the 21 October PHP security release is deployed.

## Sources

Provider status pages and blogs, aggregated with a third-party status tracker and checked against primary sources where possible; vulnerability facts from the PHP project release and from Sansec, watchTowr, and Cloudflare. Statuses are self-reported and were collected on 22 October 2026. We will update this page as hosts post more.

By W. Miller (https://digitalhosting.com/about#authors) · Editor, Digital Hosting · Last checked October 22, 2026

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "name": "Digital Hosting",
    "url": "https://digitalhosting.com"
  },
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "name": "Digital Hosting",
    "url": "https://digitalhosting.com",
    "logo": "https://digitalhosting.com/og-image.png",
    "email": "hello@digitalhosting.com",
    "description": "Independent hosting review site — comparisons for web hosting, VPS, WordPress hosting, business email, and domain registration. Not a hosting provider.",
    "parentOrganization": {
      "@type": "Organization",
      "name": "TetraCore",
      "address": {
        "@type": "PostalAddress",
        "addressRegion": "OH",
        "addressCountry": "US"
      }
    }
  }
]
```