Hosting provider patch status
We only list what a host states on its own official channels. "No statement" means we looked and found nothing at the time shown.
What the states mean
- PatchedThe host states that its PHP is fixed.
- Rolling outThe host says the fix is being rolled out.
- Action neededYou have to act, for example choose a fixed PHP version.
- Mitigation onlyOnly a workaround is offered, not a fix.
- UnconfirmedA statement exists but does not show patched, mitigated or in progress.
- No statementWe looked and found no official statement.
| Host | Status | What you must do | Source | Checked |
|---|---|---|---|---|
| SiteGroundShared hosting / Global | Mitigation only | SiteGround says server-level protections are already active on all its servers and customers do not need to change anything. It does not name patched PHP builds in the post. | 2026-10-22 23:17 UTC | |
| HostingerShared hosting / Global | Patched | Hostinger says its own tests found its platform is not vulnerable to php2shell and that it added an extra layer of protection, and that PHP upgrades are now complete across all managed hosting servers (22 Oct, 06:44 UTC). Some websites show PHP 8.5.11 rather than 8.5.12; Hostinger says this is expected because the fix was added to the version the site already uses, and that a Build Date of October 21, 2026 or later in PHP Info means the fix is applied. No action is needed from clients on Web Hosting, Agency Hosting or cPanel Hosting plans; VPS clients manage PHP themselves. | 2026-10-22 23:17 UTC | |
| BluehostShared hosting / Global | Rolling out | Bluehost says its teams are still deploying patched PHP builds across its remaining hosting infrastructure and that the majority of platforms are now up to date (update stamped Oct 22nd 18:15 est). It tells customers who manage their own VPS or dedicated servers to watch for emails about their services, links guides for changing the PHP version, and lists patched versions per platform (for example cPanel EasyApache 4 PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35). It said on 21 Oct that mitigations stay in place as an extra layer and may limit upload file size. | 2026-10-22 23:17 UTC | |
| GoDaddyShared hosting / Global | Patched | GoDaddy says (update of 22 Oct, 13:30 UTC) it has patched all PHP versions on Web Hosting; earlier updates said the same for Managed Hosting for WordPress and Windows Hosting, and customers need take no action on those. VPS owners must update PHP themselves. Its status incident 'Hosting Maintenance' was resolved at 15:07 UTC on 22 Oct. It calls this an industry-wide issue. Its blog's 22 Oct 17:15 UTC update adds that on Web Hosting the PHP version number may not change after the update (a site can still show a version like 8.5.11, because the fix was deployed as a new build with the same version number), so check the build date instead. A status post of 22 Oct 21:06 UTC (state Monitoring) says it has mitigations in place and has patched its managed services, including Web Hosting and Managed Hosting for WordPress. | 2026-10-22 23:17 UTC | |
| HostGatorShared hosting / Global | Rolling out | HostGator says its teams are still deploying patched PHP builds across its remaining hosting infrastructure and that the majority of platforms are now up to date (update stamped Oct 22nd 18:15 est). It tells customers who manage their own VPS or dedicated servers to watch for emails about their services, links guides for changing the PHP version, and lists patched versions per platform (for example cPanel EasyApache 4 PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35). It said on 21 Oct that mitigations stay in place as an extra layer and may limit upload file size. | 2026-10-22 23:17 UTC | |
| DreamHostShared hosting / Global | Rolling out | DreamHost says it put protections in place across all its hosting platforms (shared, VPS, DreamPress and dedicated), that its WAF is blocking exploit attempts, and that, as of 22 Oct 11:12 AM PDT (18:12 UTC), the official PHP security updates have been applied across the entirety of its network, with earlier mitigations staying live and no customer action needed. Its 21 Oct 1:43 PM PDT update said security fixes for PHP 8.1 and older, under its PHP Extended Support program, were expected to roll out within the next day; the later updates do not say whether those fixes were delivered. The incident is still in Monitoring. | 2026-10-22 23:17 UTC | |
| A2 HostingShared hosting / Global | Rolling out | A2 Hosting marked its 'PHP Update' incident resolved on Oct 22, 17:02 CST (about 23:02 UTC), saying the PHP-related service update has been completed successfully; that closing note names no CVE or PHP versions. Its earlier update (Oct 22, 03:09 CST) said patches were being rolled out for all PHP versions from 5.2 and above on cPanel/Plesk shared hosting and managed cPanel/Plesk servers with no customer action needed, and that on its Enhance/Control panel platform patches are installed for all versions from PHP 7.4. For self-managed servers it asks owners to make sure they have applied all vendor updates. It adds that in some cases vendors backported the fixes, so the PHP version number may not have changed, and the phpinfo() build date will show Oct 21st. | 2026-10-22 23:17 UTC | |
| NamecheapShared hosting / Global | Patched | Namecheap says its fix was implemented on all servers except Regular servers 71, 105 and 312 (22 Oct, 12:00 PM EDT), and at 12:50 PM EDT (16:50 UTC) that the maintenance has finished; the post is now marked [RESOLVED]. VPS and dedicated server owners must update PHP themselves. A later note (7:00 PM EDT) says you may see PHP 8.5.11 rather than 8.5.12 because its vendor CloudLinux keeps the base version string and backports the security fixes, so that version (for example 8.5.11-5.el8) is expected and contains the fixes for both CVEs. | 2026-10-22 23:17 UTC | |
| InMotion HostingShared hosting / Global | Rolling out | InMotion says (22 Oct, 17:10 UTC) patched PHP packages addressing both CVEs are applied on all Dedicated servers. Shared Hosting is marked complete, with CloudLinux's patched packages 'being applied across our shared hosting servers'. The VPS fleet is still in progress. On shared hosting a patched PHP may keep reporting the old version number (for example 8.3.35 rather than 8.3.36), because CloudLinux patched the existing builds. session.upload_progress.enabled stays disabled as extra hardening, and CWP/CWP Admin ports were restricted while it awaited CWP patches. A later update (22 Oct, 18:31 UTC) says CWP has released version 1.21 and that its teams are pushing the CWP update to dedicated servers, with VPS plans to follow shortly after. | 2026-10-22 23:17 UTC | |
| IONOSShared hosting / Global | Patched | IONOS says its websites and hosting are protected: it has already rolled out the official PHP updates across all platforms it operates itself (incident resolved 22 Oct, 06:10 EDT = 10:10 UTC), and customers do not need to take any action. Anyone running PHP themselves, for example on a VPS or dedicated server, should install the update for the latest PHP version immediately. | 2026-10-22 23:17 UTC | |
| OVHcloud Web HostingShared hosting / Europe | Patched | OVHcloud says all PHP releases from 7.4 to 8.5 have been patched on all Web Hosting clusters; it had earlier applied WAF rules on all clusters. It also says it is still working on the previous releases. This covers Web Hosting only, not VPS or Public Cloud. | 2026-10-22 23:17 UTC | |
| KinstaManaged WordPress / Global | Patched | Kinsta says all sites are protected and the PHP security updates have been rolled out across the platform (incident resolved 22 Oct, 08:26 UTC). Its earlier updates listed patches for PHP 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 and 8.5 rolling out, and said its Cloudflare firewall mitigations and local configuration changes would stay in place until further notice; the final update does not mention them. | 2026-10-22 23:17 UTC | |
| WP EngineManaged WordPress / Global | Patched | WP Engine says it has finished deploying the security patches for the two critical PHP vulnerabilities on its platform, that the patches are applied to each customer's PHP version, and that no action is needed. It names the updated PHP versions 7.4.33.17, 8.2.35, 8.4.27 and 8.5.12. Fixed builds named by the vendor: php85 8.5.12, php84 8.4.27, php82 8.2.35, php74 7.4.33.17 | 2026-10-22 23:17 UTC | |
| CloudwaysManaged WordPress / Global | Patched | Cloudways says the PHP security patch rollout is complete and all active servers have been successfully updated (22 Oct, 10:11 UTC); patches for all customer applications on Autonomous were applied by 01:02 UTC. Its support team is proactively contacting a small subset of customers whose environments need additional assistance. Interim configuration-level mitigations recommended by the PHP Group were deployed earlier; the rollout covered all supported PHP versions including deprecated ones (5.6 and above), and no action was needed from customers. | 2026-10-22 23:17 UTC | |
| PantheonManaged WordPress / Global | Rolling out | Pantheon says patched PHP builds are deployed on all live environments (PHP 8.2 or later, and all LTS versions), all environments in SFTP mode, and all pre-production customer environments. Free/sandbox environments will be updated over the next 24-48 hours. Network-level mitigations stay in place, and Pantheon says no customer action is required. | 2026-10-22 23:17 UTC | |
| WordPress.comManaged WordPress / Global | Unconfirmed | Automattic says WordPress.com sites are protected and it worked with the PHP security team; no customer action is stated. | 2026-10-22 23:17 UTC | |
| PressableManaged WordPress / Global | Unconfirmed | Pressable says every PHP version on its platform is already protected against both vulnerabilities (production, staging, sandbox); customers need no action. | 2026-10-22 23:17 UTC | |
| FlywheelManaged WordPress / Global | Patched | Flywheel says WP Engine has finished deploying the PHP security patches on the Flywheel platform; the patch has been applied to your PHP version and no action is needed. Protective mitigations were also in place at the CDN and host layers. | 2026-10-22 23:17 UTC | |
| NexcessManaged WordPress / Global | Rolling out | Nexcess (a Liquid Web brand) says its engineering teams are continuing to deploy and verify patched PHP builds across its hosting environments and that the rollout is progressing (22 Oct, 10:42 EDT = 14:42 UTC). Its 15:28 EDT (19:28 UTC) update says it is still assessing the remaining environments and will share further updates as patching progresses. On 21 Oct it had said no patches had been rolled out to production yet. | 2026-10-22 23:17 UTC | |
| Liquid WebVPS / cloud / Global | Rolling out | Liquid Web says its engineering teams are actively working to deploy patched PHP builds across its hosting infrastructure. It lists the current patched builds: cPanel PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 plus vendor backports 8.1.34-5, 8.0.30-12 and 7.4.33-19; Plesk (v18.0.81.4) PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, plus end-of-life 8.1, 8.0 and 7.4 builds made on 21 Oct 2026; and Windows Plesk PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It tells customers who are not patched yet to run a package update through their control panel. It does not say its own managed hosting is fully patched. Its 22 Oct 10:33 EDT (14:33 UTC) update lists cPanel EasyApache4 builds (ea-php74 7.4.33-19 to ea-php85 8.5.12) and CloudLinux EasyApache4 builds (for example ea-php85 8.5.11-2, CloudLinux backport builds with lower numbers), and still does not say its managed hosting is fully patched. Its 22 Oct 15:28 EDT (19:28 UTC) update says the work is progressing in stages and that it is still assessing the remaining environments. Fixed builds named by the vendor: cpanel-php85 8.5.12, cpanel-php84 8.4.27, cpanel-php83 8.3.36, cpanel-php82 8.2.35, cpanel-php81 8.1.34-5, cpanel-php80 8.0.30-12, cpanel-php74 7.4.33-19 | 2026-10-22 23:17 UTC | |
| DigitalOcean App PlatformApp platform (PaaS) / Global | Action needed | DigitalOcean says the App Platform PHP buildpack has been patched; you must redeploy your app to pick up the latest buildpack and safe PHP. If you deploy from your own Dockerfile or container image, update the PHP version in that image and redeploy. The post does not name buildpack PHP versions. | 2026-10-22 23:17 UTC | |
| HerokuApp platform (PaaS) / Global | Action needed | Heroku released PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on its PHP runtime; you must redeploy your app to pick them up. PHP 8.1.34 on Heroku-22 was rebuilt with the PHP project's backported fix. | 2026-10-22 23:17 UTC | |
| RenderApp platform (PaaS) / Global | No statement | No statement about this PHP issue found on Render's official channels as of the check. | 2026-10-22 23:17 UTC | |
| Platform.sh / UpsunApp platform (PaaS) / Global | Rolling out | Upsun's status page says updated PHP images were deployed to all grid regions across its fleet at 23:35 UTC on 21 Oct and that the PHP security patch finished deploying to all Dedicated clusters at 04:12 UTC on 22 Oct. Its blog (status of 22 Oct, 04:12 UTC) says it has patched every php runtime image from PHP 7.4 to 8.5 (including backported fixes for 7.4, 8.0 and 8.1) and redeployed the affected environments, but the composable image update is still in progress. It strongly recommends customers running PHP versions below 8.x upgrade to PHP 8 as soon as possible; they are protected by its edge-layer mitigations in the meantime. No update will be available for PHP 7.3 or earlier. Brief downtime is possible while containers are refreshed. | 2026-10-22 23:17 UTC | |
| Laravel CloudApp platform (PaaS) / Global | Patched | Laravel Cloud says it has patched every running application with the PHP security release and deployments have resumed. Applications now run PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 depending on the version used, patched in place with no redeploy needed. All new deployments use updated base images that include the patched versions. Fixed builds named by the vendor: php85 8.5.12, php84 8.4.27, php83 8.3.36, php82 8.2.35 | 2026-10-22 23:17 UTC | |
| Laravel ForgeControl panel / Global | Action needed | Forge users must still update PHP on their own servers. Laravel's post (updated 21 Oct 23:26 UTC) says that if you use PHP 8.2, 8.3, 8.4 or 8.5 you go to your server in Forge and click 'Update PHP', once per server, or update over SSH if that fails. Servers running Ubuntu 20.04 or older cannot be updated: create a new server on a supported Ubuntu and move your sites. For PHP 8.0 and 8.1 it says no patch is available. Forge's own advisory says its automatic security updates do not patch PHP and that PHP 8.1 and earlier get no official fix. | 2026-10-22 23:17 UTC | |
| AWS Elastic Beanstalk (PHP)App platform (PaaS) / Global | Action needed | AWS says its Elastic Beanstalk Amazon Linux 2023 PHP platform versions 4.13.13 now ship PHP 8.5.12 and PHP 8.4.27 (release of 21 Oct 2026) and PHP 8.3.36 and PHP 8.2.35 (release of 22 Oct 2026), which address both CVEs. AWS notes that new platform versions might not yet be available in all AWS Regions and can take a few hours to complete. Environments with Managed Platform Updates enabled get the new platform version automatically in their next maintenance window; otherwise you must update the environment's platform version yourself. Our guidance: Update the environment to platform version 4.13.13 or later on PHP 8.5, 8.4, 8.3 or 8.2 (or enable Managed Platform Updates), and check the platform history for your Region. Fixed builds named by the vendor: php85 8.5.12, php84 8.4.27, php83 8.3.36, php82 8.2.35 | 2026-10-22 23:17 UTC | |
| Amazon LightsailVPS / cloud / Global | Action needed | AWS documents how Lightsail owners update PHP themselves. On instances created from the Lightsail-packaged blueprints (WordPress, WordPress Multisite, LAMP and Nginx) PHP comes from the operating system package repositories and is updated with the package manager. Instances created from Bitnami blueprints keep their own copy of PHP that apt upgrade does not update, and AWS recommends moving to a Lightsail-packaged blueprint. AWS lists the fixed versions as 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Our guidance: Take a snapshot, run sudo apt update and sudo apt upgrade, restart the web server, then paste the apt policy or dpkg -l output into this site's Linux package checker (Lightsail's packaged PHP keeps Ubuntu or Debian version numbers, not the upstream ones). For Bitnami-blueprint instances follow AWS's Lightsail guide for moving to a Lightsail-packaged blueprint or replacing the Bitnami PHP. | 2026-10-22 23:17 UTC | |
| Azure App Service (Linux, PHP)App platform (PaaS) / Global | Rolling out | Microsoft says the updated built-in PHP images are now rolled out to the Latest and Standard release channels for App Service on Linux (PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12). The Extended channel gets the fix last, so it advises switching to Standard or Latest. WordPress apps from the official WordPress on App Service offering in Microsoft Marketplace have been updated to patched PHP, except apps still on the older Alpine-based images, which will not receive the patches. Custom containers must be rebuilt by you, and end-of-life PHP runtimes are not patched. Fixed builds named by the vendor: php82 8.2.35, php83 8.3.36, php84 8.4.27, php85 8.5.12 | 2026-10-22 23:17 UTC | |
| Google Cloud (App Engine, Cloud Run)Cloud platform / Global | Action needed | Google Cloud says App Engine standard (PHP 8.2+) is patched automatically; other services need a redeploy or rebuild with fixed PHP (8.5.12, 8.4.27, 8.3.36, 8.2.35). PHP 8.1 and older will not be patched. | 2026-10-22 23:17 UTC | |
| HetznerVPS / cloud / Europe | Patched | Hetzner says it has deployed patches for PHP 7.4 and 8.0 to 8.5, and then for the remaining PHP versions 5.6 and 7.3, on all Webhosting and Managed Servers. Dedicated and cloud server customers are being notified separately by email. | 2026-10-22 23:17 UTC | |
| netcupShared hosting / Europe | Patched | netcup says all Webhosting packages (including Reseller) and all Managed Servers have been patched and secured and are online, and that no unpatched PHP version is online on them. The Webhosting Control Panel is back online after Plesk provided an updated version. Root server, VPS and managed cloud cluster customers manage their own systems and must patch PHP themselves. | 2026-10-22 23:17 UTC | |
| HostnetShared hosting / Europe | Patched | Hostnet says the PHP security update has been rolled out on all of its systems and the vulnerabilities are fixed, including older PHP versions via PHP Extended Support; its temporary measures were lifted at 00:26 UTC on 22 Oct. A 22 Oct news article says the update was rolled out on the Shared Hosting and Managed VPS platforms; Unmanaged VPS owners manage their own software and are urged to update PHP as soon as possible. | 2026-10-22 23:17 UTC | |
| InfomaniakShared hosting / Europe | Patched | Infomaniak says the PHP security fixes have been deployed on its entire shared Web Hosting and Cloud Server infrastructure for PHP 8.5, 8.4, 8.3, 8.2, 8.1, 8.0 and 7.4 (22/10 07:42, local time as shown on the page). PHP version numbers stay unchanged but the fixes are applied on all the services concerned. Versions older than PHP 7.4 must be upgraded. It disabled session.upload_progress.enabled as a temporary mitigation and temporarily limited file uploads on several of its other services. Its 22/10 17:03 update lists the builds in use (8.5.11, 8.4.26, 8.3.35, 8.2.34, 8.1.34, 8.0.30, 7.4.33), recompiled with the security fixes, and says it will offer 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as soon as possible. | 2026-10-22 23:17 UTC | |
| TransIPShared hosting / Europe | No statement | No statement about this PHP issue found on TransIP's official website as of the check. TransIP's status page could not be reached. | 2026-10-22 23:17 UTC | |
| o2switchShared hosting / Europe | No statement | No statement about this PHP issue found on o2switch's official channels as of the check. | 2026-10-22 23:17 UTC | |
| GandiShared hosting / Europe | No statement | No statement about this PHP issue found on Gandi's official channels as of the check. | 2026-10-22 23:17 UTC | |
| cPanel & WHM (EasyApache 4)Control panel / Global | Patched | EasyApache 4 25.91 (21 Oct 2026) ships fixed ea-php82 to ea-php85 and backported patches for the end-of-life ea-php74, ea-php80 and ea-php81. Install the EasyApache 4 update through the normal system update, then restart PHP (Apache, PHP-FPM or LSAPI) so the new build is loaded. cPanel also updated the PHP inside cPanel & WHM itself (it affects cPanel interfaces, including Roundcube webmail): cPanel & WHM 138.0.18, 136.0.50 and 134.0.66 include PHP 8.4.27, and 110.0.153 includes backported fixes for PHP 8.1.34. On CloudLinux, CloudLinux's own ea-php builds carry the fix under lower version numbers (for example 8.4.26-2.elX.cloudlinux.1), so check the package changelog for the CVE IDs rather than comparing with the numbers above. Fixed builds named by the vendor: ea-php85 8.5.12-1, ea-php84 8.4.27-1, ea-php83 8.3.36-1, ea-php82 8.2.35-1, ea-php81 8.1.34-5, ea-php80 8.0.30-12, ea-php74 7.4.33-19 | 2026-10-22 23:17 UTC | |
| CloudLinux (alt-php)Control panel / Global | Action needed | CloudLinux says fixed alt-php packages are in its stable repositories (release complete 22 Oct 2026, 00:07 UTC): alt-php 5.2-5.6, 7.0-7.4 and 8.0-8.5 on CloudLinux OS 7, 8 and 9; alt-php 5.2, 5.6, 7.0-7.4 and 8.0-8.5 on CloudLinux OS for Ubuntu 22.04; and, on CloudLinux OS 10, alt-php 5.2 (the other versions come from the ELS ALT PHP repository). A regular update now installs all of these, followed by a restart of PHP. The packages carry the fix as a backport and keep their own lower version numbers, so CloudLinux says to confirm the fix in the package changelog. CloudLinux 6 is not confirmed yet. On 22 Oct 14:31 UTC it says fixed alt-php and ea-php packages carry the fix as a backport and so show an older PHP number (it gives alt-php85 8.5.11-5 and, on CloudLinux OS 8, ea-php84 8.4.26-2.el8.cloudlinux.1 as examples); it says alt-php builds with PHP.net version numbers will follow. Its 22 Oct 19:50 UTC update says fixed native PHP packages from the CloudLinux OS repositories are now in the stable channel for every affected version (CloudLinux OS 10: PHP 8.3; OS 9: PHP 8.0, 8.1, 8.2 and 8.3; OS 8: PHP 7.2, 7.3, 7.4, 8.0 and 8.2; OS 7: PHP 5.4 via TuxCare ELS), installed by a regular package update. Our guidance: On CloudLinux OS 7 run yum clean all && yum update "alt-php*"; on CloudLinux OS 8, 9 and 10 run dnf clean all && dnf upgrade "alt-php*"; on CloudLinux OS for Ubuntu run apt-get update && apt-get upgrade. Then restart Apache, PHP-FPM or LiteSpeed, and check the changelog, for example rpm -q --changelog alt-php74-common | grep -E "CVE-2026-(109618|109619)". Security-only updates (yum --security) do not list these packages yet. | 2026-10-22 23:17 UTC | |
| Plesk ObsidianControl panel / Global | Action needed | Plesk says fixed PHP builds are available: PHP 8.2 to 8.5 as 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on Plesk for Linux and Plesk for Windows. On Linux, the end-of-life PHP 7.4.33, 8.0.30 and 8.1.34 keep their version numbers, and the builds made on 21 Oct 2026 include the fixes. Plesk's own interface engine (sw-engine) is fixed in Plesk Obsidian 18.0.80 Update 11 and 18.0.81 Update 4. Plesk's call to action is to update Plesk to the latest available version. Our guidance: Install the Plesk updates on your server (Plesk's own call to action is to update Plesk), then check the PHP version for each handler under Tools & Settings > PHP Settings. For PHP 7.4, 8.0 and 8.1 on Linux the version number does not change, so check the build date (21 Oct 2026 or later). If your site is on a host's shared server, ask the host whether it has installed the update. | 2026-10-22 23:17 UTC | |
| DirectAdmin (CustomBuild)Control panel / Global | Action needed | DirectAdmin released a build on 21 Oct that bumps CustomBuild PHP 8.5, 8.4, 8.3 and 8.2 to the latest versions and adds patches for PHP 8.1, 8.0 and 7.4. A later build adds patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and a small fix for the PHP 8.1 compilation. A further build for the legacy rhel7 and debian10 release channels comes with the latest PHP versions and all security patches, and a newer build for those channels (22 Oct, about 06:18 UTC) fixes the patching order on servers that use LiteSpeed, where patches failed to apply in lsphp mode before. The PHP upgrade is not automatic: run 'da update' then 'da build php' (unless the CustomBuild cron is enabled). Staff earlier noted PHP 8.1 may not build cleanly on some systems. | 2026-10-22 23:17 UTC | |
| Webuzo (Softaculous)Control panel / Global | Action needed | Webuzo says it has released updated EMPS packages (the PHP stack Webuzo ships) and end-user PHP that address CVE-2026-109618 and CVE-2026-109619, and that it launched PHP 5.6 to 8.5 with patches (EMPS 5.6 is updated to PHP 7.4 with the patches). It recommends all Webuzo users update EMPS and all PHP as soon as possible by running commands as root (webuzo --emps update, then update each installed PHP, or use Admin Panel -> Update Apps if auto updates were off). Webuzo 4.8.5 (stable, 22 Oct 2026) includes the EMPS security fix and says EMPS will be updated automatically. Webuzo does not name PHP version numbers. | 2026-10-22 23:17 UTC | |
| CyberPanelControl panel / Global | Action needed | CyberPanel now says fixed LiteSpeed packages are available and that it updated PHP to 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on its own Ubuntu 26.04 test server, where the checks passed. It later added (22 Oct) that its authenticated LiteSpeed Ubuntu 20.04 package index lists fixed-version candidates and that a PHP 8.3 deployment on one Ubuntu 20.04 test host reports PHP and OPcache 8.3.36 (09:50 UTC); it says these results cover only the tested host and branch. Administrators must update every PHP runtime and its modules themselves, refresh CyberPanel's separate panel PHP copy, restart workers and verify. PHP 8.1 and older need a vendor backport or migration. Fixed builds named by the vendor: php85 8.5.12, php84 8.4.27, php83 8.3.36, php82 8.2.35 | 2026-10-22 23:17 UTC | |
| VirtualminControl panel / Global | Mitigation only | Virtualmin staff say Virtualmin does not provide PHP packages and that the operating system does (forum reply, 21 Oct 19:11 UTC), so the PHP fix comes from your OS or PHP package source. An earlier pre-release staff post suggested turning off one PHP session setting in the PHP-FPM pool as a partial step. No Virtualmin list of patched packages was found. | 2026-10-22 23:17 UTC | |
| ISPConfigControl panel / Global | Mitigation only | ISPConfig says this is not an ISPConfig vulnerability and the real fix is an updated PHP from your distribution or PHP repository (Debian, Ubuntu, sury.org and others). As a temporary measure it published 'ispconfig-multipart-guard', which blocks multipart (file upload) requests in nginx or Apache; uploads on blocked sites stop working until you install the PHP update and switch the guard off. | 2026-10-22 23:17 UTC | |
| aaPanelControl panel / Global | Action needed | aaPanel staff (post edited 22 Oct 11:07 UTC) say patches are available for PHP 7.4 to 8.5 only (update to 8.5.12, 8.4.27, 8.3.36, 8.2.35, 8.1.35, 8.0.27 or 7.4.34, as the post names them); a staff reply on 22 Oct 01:39 UTC says fixes were added for the 7.4, 8.0 and 8.1 updates. The post now also offers aaPanel self-built patched builds for PHP 7.0, 7.1, 7.2 and 7.3 (7.0.34, 7.1.34, 7.2.35, 7.3.34, installed with a script from node.aapanel.com; aaPanel says to test first); these are aaPanel's own builds, not PHP project releases. Update in the App Store: click 'Update App List', find the PHP version, click Update, and repeat for each installed PHP version; take a snapshot first. Users on PHP 5.6 or older are pointed to configuration mitigation only. Do not judge the 8.1, 8.0 and 7.4 builds by number alone: the post's numbers for those branches are not PHP project fixed releases (php.net's 8.0.27 is an older, unfixed release). Several users in the same thread report failed or very slow PHP builds in the panel. Fixed builds named by the vendor: php85 8.5.12, php84 8.4.27, php83 8.3.36, php82 8.2.35 | 2026-10-22 23:17 UTC | |
| Cloudflare WAFCDN / WAF / Global | Mitigation only | Cloudflare deployed managed WAF rules for php2shell that are on by default for Free and paid plans (from 21 Oct 2026 03:02 UTC). It also released a new response-side managed rule (Cloudflare Managed Response Firewall Default, 'Default block for High confidence Signatures') on all plans including Free, which looks at the origin's response as well as the request. They are an extra layer only: Cloudflare says to patch PHP anyway, and traffic that reaches your server without passing through Cloudflare is not covered. Paid plans should check that the Managed Ruleset is deployed in block mode. | 2026-10-22 23:17 UTC | |
| Sucuri Website FirewallCDN / WAF / Global | Mitigation only | Sucuri has deployed extra WAF rules for the two PHP CVEs on its Website Firewall (status: 'Monitoring', 21 Oct 2026 15:14 UTC). A Sucuri blog post (21 Oct, 21:12 UTC) adds that more refined virtual patching rules for known exploitation paths are now deployed across its WAF network, that the WAF only works for requests passing through the firewall (direct connections to the origin can bypass it), and that you must still update PHP. Sucuri stresses this does not replace patching PHP on the origin server: ask your host to update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or a vendor-patched package. | 2026-10-22 23:17 UTC | |
| Wordfence (WordPress)CDN / WAF / Global | Action needed | Wordfence published a post-release notice: PHP has released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix both vulnerabilities, WordPress automatic updates will not fix them, and PHP must be updated by your host or on your own server. A follow-up post (22 Oct 00:51 UTC) says its Threat Intelligence team reviewed PHP's patches and tested the behaviour in lab environments, that its firewall protects the WordPress application layer only, and that updating and restarting PHP is essential. It does not announce a firewall rule for these CVEs. | 2026-10-22 23:17 UTC | |
| Patchstack (WordPress)CDN / WAF / Global | Action needed | Patchstack's alert (21 Oct 2026) says to update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor's patched package) and to contact your vendor for a backport or upgrade if you run PHP 8.1 or older. It lists configuration measures as partial only and recommends against unofficial 'fix' plugins. The page does not mention a Patchstack virtual patch for this issue. | 2026-10-22 23:17 UTC | |
| Imunify360 (CloudLinux)CDN / WAF / Global | Mitigation only | Imunify360's WAF rules are an interim mitigation, not a fix. Rulesets 8.83 to 8.85 (21 Oct) are delivered automatically to servers with Imunify360 and its WAF enabled; on Apache, Nginx and Coraza they block the known exploit requests and the public exploit tool, and since ruleset 8.84 LiteSpeed also blocks the tool and upload-progress requests that do not come from the site's own pages. Imunify360 also gives scanning IPs a CAPTCHA challenge. CloudLinux says the rules target only the upload-progress path of CVE-2026-109619 and that no rule blocks the out-of-memory path of CVE-2026-109618 yet; ImunifyAV and servers with the WAF disabled get no coverage. Updating PHP is still the action to take: CloudLinux's blog (22 Oct 01:25 UTC) says fixed alt-php packages are now in stable. | 2026-10-22 23:17 UTC | |
| さくらのレンタルサーバ / さくらのマネージドサーバ (Sakura Internet)Shared hosting / Japan | Patched | Sakura Internet says it has completed the fix for the PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) for every PHP version that can be selected in the control panel, for Rental Server and Managed Server. Its emergency maintenance 'PHP version upgrade' is marked completed at 2026-10-22 06:30 JST. Its notice still says phpMyAdmin and webmail were being handled (webmail added as complete at 13:45 JST), while its maintenance entry for the partial-function stop shows webmail, old webmail and File Manager restored at 13:45 JST and phpMyAdmin at 15:15 JST. Our guidance: Sakura says no urgent action is needed from customers. It also suggests moving to the newest PHP version still in its support period; if you do, check that your app works on it and take a backup first. | 2026-10-22 23:17 UTC | |
| エックスサーバー (Xserver)Shared hosting / Japan | Rolling out | Xserver Inc.'s official X account says (post of 21:14 JST on 22 Oct) that fix patches have been applied on all target servers for PHP 5.6 to 8.5, and that it is still creating and verifying patches for PHP 5.5 and older. Earlier posts said the same for PHP 7.4 to 8.1 (12:08 JST). It also says the service sites resumed in sequence from 20:10 JST, with some functions still under maintenance. Our guidance: The notice does not ask customers to do anything now. Xserver says it may ask customers for additional steps depending on how they use the service and will announce them separately, so check the host's notice (site and X @xserverjp) and act only if it asks. If you run PHP 5.5 or older, check with the host before relying on it. | 2026-10-22 23:17 UTC | |
| Xserverビジネス (Xserver Business)Shared hosting / Japan | Rolling out | Xserver Inc.'s official X account says (post of 21:14 JST on 22 Oct) that fix patches have been applied on all target servers for PHP 5.6 to 8.5, and that it is still creating and verifying patches for PHP 5.5 and older. Earlier posts said the same for PHP 7.4 to 8.1 (12:08 JST). It also says the service sites resumed in sequence from 20:10 JST, with some functions still under maintenance. The company-wide notice does not name Xserver Business. Our guidance: The notice does not ask customers to do anything now. Xserver says it may ask customers for additional steps depending on how they use the service and will announce them separately, so check the host's notice (site and X @xserverjp) and act only if it asks. If you run PHP 5.5 or older, check with the host before relying on it. | 2026-10-22 23:17 UTC | |
| シンレンタルサーバー (Shin Rental Server)Shared hosting / Japan | Rolling out | Xserver Inc.'s official X account says (post of 21:14 JST on 22 Oct) that fix patches have been applied on all target servers for PHP 5.6 to 8.5, and that it is still creating and verifying patches for PHP 5.5 and older. Earlier posts said the same for PHP 7.4 to 8.1 (12:08 JST). It also says the service sites resumed in sequence from 20:10 JST, with some functions still under maintenance. The company-wide notice does not name Shin Rental Server. Our guidance: The notice does not ask customers to do anything now. Xserver says it may ask customers for additional steps depending on how they use the service and will announce them separately, so check the host's notice (site and X @xserverjp) and act only if it asks. If you run PHP 5.5 or older, check with the host before relying on it. | 2026-10-22 23:17 UTC | |
| スターレンタルサーバー / スターサーバー (Star Server)Shared hosting / Japan | Rolling out | Xserver Inc.'s official X account says (post of 21:14 JST on 22 Oct) that fix patches have been applied on all target servers for PHP 5.6 to 8.5, and that it is still creating and verifying patches for PHP 5.5 and older. Earlier posts said the same for PHP 7.4 to 8.1 (12:08 JST). It also says the service sites resumed in sequence from 20:10 JST, with some functions still under maintenance. The company-wide notice does not name Star Rental Server. Our guidance: The notice does not ask customers to do anything now. Xserver says it may ask customers for additional steps depending on how they use the service and will announce them separately, so check the host's notice (site and X @xserverjp) and act only if it asks. If you run PHP 5.5 or older, check with the host before relying on it. | 2026-10-22 23:17 UTC | |
| ロリポップ！レンタルサーバー (GMO Pepabo)Shared hosting / Japan | Patched | GMO Pepabo says on its official X account that it applied the fixed version and restored customers' sites at 13:11 JST on 22 Oct, and that it also applied its own fixes to older PHP versions that have no official fix. Its recovery notice (16:27 JST) names CVE-2026-109618 / CVE-2026-109619 and says the fix application is complete and customers' sites resumed around 13:00. It says it stopped customers' sites server by server to protect all sites, including those not on PHP 8.2 or later. The service site, apart from some parts, is to resume shortly. Our guidance: Lolipop's recovery notice (official X, 16:27 JST) asks customers to move to PHP 8.2 or later, to check that WordPress core, plugins and themes are up to date, and to check that the site, forms and file uploads work. Watch @lolipopjp for when the service site is fully back. | 2026-10-22 17:17 UTC | |
| ヘテムル (heteml, GMO Pepabo)Shared hosting / Japan | Patched | GMO Pepabo says in its final report (22 Oct) that the fix is applied on every PHP version: the upstream fixed builds 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 on PHP 8.2 to 8.5, the upstream patch for the end-of-life PHP 7.4 / 8.0 / 8.1, and its own fixes for PHP 5.6 to 7.3. It says customer sites resumed at 11:24 JST and, as of its 18:05 JST addendum, all services are back. It also says the session.upload_progress feature is disabled on all versions and asks customers to check their sites. Our guidance: Check that your own site still works: the host says the session.upload_progress feature is disabled on all PHP versions. It also suggests moving to PHP 8.2 or later, which is still supported upstream; PHP 8.1 and older fixes are stopgaps. Fixed builds named by the vendor: php8.2 8.2.35, php8.3 8.3.36, php8.4 8.4.27, php8.5 8.5.12 | 2026-10-22 23:17 UTC | |
| レンタルサーバーCPIShared hosting / Japan | Rolling out | CPI's notice page says it is urgently working on the PHP versions for which the latest official patch exists, and will update on versions without a patch; the patch application status is to be announced later on the same page. Customer servers keep running and sites and mail work as usual. The service site (21:00 JST on 22 Oct), control panel (about 17:00), My Page (about 16:00) and Roundcube webmail (about 13:11) have resumed; the secure file manager is expected from 30 Oct or later. It states no unauthorized access or attack has been observed. For PHP versions the patch cannot be applied to, it describes php.ini changes as a risk-reduction step and says it does not support php.ini changes. Our guidance: No customer action is requested. Sites and mail keep working. For PHP versions the patch cannot be applied to, CPI describes php.ini settings as a risk-reduction step (not supported by CPI). Watch CPI's notice page for the patch status. | 2026-10-22 23:17 UTC | |
| KAGOYA レンタルサーバー (カゴヤ・ジャパン)Shared hosting / Japan | Rolling out | KAGOYA's notice naming CVE-2026-109618 / CVE-2026-109619 (newest update on 22 Oct, page modified 18:48 JST) says that for Rental Server plans (PHP 7.4, 8.1, 8.2, 8.3, 8.4, 8.5) it is updating to the fixed versions in sequence and expects to finish at 24:00 on 22 Oct. For Managed Dedicated, Shared Server and WordPress-dedicated plans it says the permanent response is still being decided, and as an interim risk reduction it asks owners to consider taking the site offline (switching to a maintenance screen) or restricting access. Our guidance: On the Rental Server plan, KAGOYA is already updating; wait for it to finish and watch the same notice page. On Managed Dedicated, Shared Server and WordPress-dedicated plans KAGOYA suggests interim steps such as taking the site offline or restricting access (its notice shows an .htaccess example). | 2026-10-22 23:17 UTC | |
| ConoHa WING (GMO Internet)Shared hosting / Japan | Patched | ConoHa says in its final report (official X, posted 21:01 JST on 22 Oct) that all its response to the PHP vulnerability is complete: as of 20:45 JST on 22 Oct the security patches have been applied to its servers. Its earlier report (18:00 JST) had said patching was still in sequence, with Webmail and File Manager resumed and phpMyAdmin still suspended. Our guidance: ConoHa says you do not need to change your PHP version yourself. It applied the patches inside each PHP version rather than upgrading it, so a tool such as WordPress Site Health may still show the older version number (for example 8.5.11); the host says this is expected. | 2026-10-22 17:17 UTC | |
| お名前.com レンタルサーバー (GMO Internet)Shared hosting / Japan | Rolling out | GMO Internet says its emergency server maintenance since 2026-10-21 and the temporary suspension of File Manager, phpMyAdmin and Webmail are part of its response to the fixed version of PHP released on 2026-10-21 (23:00 JST). It says it is applying security patches to servers in sequence while keeping each customer's current PHP version. Customers basically do not need to change their PHP version, but it says a change may be needed for some customers on PHP 5.x or 7.x. Website display and mail work as usual. Our guidance: Basically no PHP version change is needed. If you are on PHP 5.x or 7.x, check the host's notices, because a change may be needed. File Manager, phpMyAdmin and Webmail are suspended as a precaution. | 2026-10-22 17:17 UTC | |
| カラフルボックス / カラフルビジネス (ColorfulBox)Shared hosting / Japan | Patched | ColorfulBox says that protective measures and the security-fix update work on all its servers (shared server, ColorfulBusiness, Tada Server, dedicated server) were all completed by the morning of 2026-10-22. It says the servers were updated to fixed builds while keeping each customer's PHP version, so customers do not need to change or switch PHP versions. It says older versions such as PHP 7.4 and PHP 8.0/8.1 are also covered by security fixes and protective measures on the server side, in addition to the latest fixed releases of PHP 8.2 to 8.5. Our guidance: ColorfulBox says no action is needed and that you do not need to change your PHP version. | 2026-10-22 23:17 UTC | |
| mixhost (ミックスホスト)Shared hosting / Japan | Patched | mixhost says that at about 10:18 JST on 2026-10-22 it finished applying the PHP fix packages on all servers of mixhost Rental Server, mixhost Adult Rental Server and mixhost Overseas Rental Server, for CVE-2026-109618 and CVE-2026-109619. It says the scope is PHP 5.2 to 8.5, including versions that upstream no longer fixes, through CloudLinux's own fix packages. The fix does not change the PHP version number shown (for example 8.4.26 stays 8.4.26). It says no customer action is needed and recommends PHP 8.2 or later for customers on older versions. Our guidance: mixhost says no customer action is needed. The PHP version number shown in WordPress Site Health or phpinfo does not change after the fix. If you are on PHP below 8.2, it recommends moving to 8.2 or later. | 2026-10-22 23:17 UTC | |
| CORESERVER V1 / V2 (コアサーバー, Value Domain)Shared hosting / Japan | Patched | Value Domain's status page names CVE-2026-109618 / CVE-2026-109619 and marks both CORESERVER maintenances completed. For CORESERVER V1 (all servers, completed 00:50 JST on 22 Oct) it says the fix is complete for every PHP version it offers (PHP 5.3 to 8.5), and for CORESERVER V2 (all servers, completed 11:13 JST) for every PHP version it offers (PHP 5.2 to 8.5). It says customers do not need to change their PHP version. Our guidance: Value Domain says no PHP version change is needed on your side. | 2026-10-22 23:17 UTC | |
| XREA (エクスリア, Value Domain)Shared hosting / Japan | Patched | Value Domain's status page names CVE-2026-109618 / CVE-2026-109619 and marks the XREA maintenance (all servers, completed 00:50 JST on 22 Oct) completed. It says the fix is complete for every PHP version it offers (PHP 5.3 to 8.5) and that customers do not need to change their PHP version. Our guidance: Value Domain says no PHP version change is needed on your side. | 2026-10-22 23:17 UTC | |
| VALUESERVER (バリューサーバー, Value Domain)Shared hosting / Japan | Patched | Value Domain's status page names CVE-2026-109618 / CVE-2026-109619 and marks the VALUESERVER maintenance (all servers, completed 00:50 JST on 22 Oct) completed. It says the fix is complete for every PHP version it offers (PHP 5.3 to 8.5) and that customers do not need to change their PHP version. Our guidance: Value Domain says no PHP version change is needed on your side. | 2026-10-22 23:17 UTC | |
| Oneレンタルサーバー (Value Domain / GMO DigiRock)Shared hosting / Japan | Patched | Value Domain's status page names CVE-2026-109618 / CVE-2026-109619 and marks the One Rental Server (Oneレンタルサーバー) maintenance (all servers, completed 10:20 JST on 22 Oct) completed. It says the fix is complete for every PHP version it offers (PHP 5.6 to 8.5) and that customers do not need to change their PHP version. Our guidance: Value Domain says no PHP version change is needed on your side. | 2026-10-22 23:17 UTC | |
| WebARENA (NTTPC)Shared hosting / Japan | Mitigation only | NTTPC's notice for WebARENA SuiteX / SuiteS (2026-10-22 update) names CVE-2026-109618 and CVE-2026-109619. After first restricting web access from outside Japan, it is also stopping web access from inside Japan in sequence: from 18:00 JST on 22 Oct for SuiteX and from 17:30 JST on 22 Oct for SuiteS. For SuiteX it says PHP 8.3 will be upgraded to 8.3.36 on 22 Oct without a web stop, PHP 7.4 on servers opened from 19 Nov 2025 will be swapped for PHP 8.3 and rolled back to a patched PHP 7.4 from 23 Oct, and servers opened on or before 18 Nov 2025 (PHP 7.4 / 7.2 / 5.6 / 5.3 / 5.1) cannot be patched, so web access stays stopped until an effective fix is possible. For SuiteS it says PHP 7.2 / 5.6 / 5.3 / 5.1 cannot be patched, so web access stays stopped until an effective fix is possible. The customer contract management screen is stopped with no date set. The notice does not say a PHP fix has already been applied. Our guidance: WebARENA says that PHP 7.4 on servers opened from 19 Nov 2025 will be switched to PHP 8.3 on 22 Oct, so some content may not display correctly. Web pages, management tools, phpMyAdmin, webmail and the contract management screen are being stopped as described in its notice; FTP stays available. Watch the same notice page for restart timing and fee relief. | 2026-10-22 23:17 UTC | |
| ABLENET (旧ケイアンドケイコーポレーション)VPS / cloud / Japan | No statement | No PHP-specific statement found. The latest security item (2026-10-20) is about the Linux kernel CVE-2026-99999 for VPS, a different issue. Our guidance: No instruction. If you run PHP yourself, update the OS package and check the version. | 2026-10-22 23:17 UTC |