Patchstatus van hosters
We vermelden alleen wat een hoster zelf meldt via zijn officiële kanalen. "Geen melding" betekent dat we hebben gezocht en op het aangegeven moment niets vonden.
Wat de statussen betekenen
- GepatchtDe hoster meldt dat zijn PHP is opgelost.
- Wordt uitgeroldDe hoster zegt dat de fix wordt uitgerold.
- Actie nodigJij moet zelf iets doen, bijvoorbeeld een opgeloste PHP-versie kiezen.
- Alleen workaroundEr is alleen een workaround, geen fix.
- OnbevestigdEr is een melding, maar die laat niet zien of het gepatcht, tijdelijk afgedekt of in uitvoering is.
- Geen meldingWe hebben gezocht en vonden geen officiële melding.
| Hoster | Status | Wat jij moet doen | Bron | Gecontroleerd |
|---|---|---|---|---|
| SiteGroundGedeelde hosting / Wereldwijd | Alleen workaround | SiteGround says server-level protections are already active on all its servers and customers do not need to change anything. It does not name patched PHP builds in the post. | 2026-10-22 23:17 UTC | |
| HostingerGedeelde hosting / Wereldwijd | Gepatcht | Hostinger says its own tests found its platform is not vulnerable to php2shell and that it added an extra layer of protection, and that PHP upgrades are now complete across all managed hosting servers (22 Oct, 06:44 UTC). Some websites show PHP 8.5.11 rather than 8.5.12; Hostinger says this is expected because the fix was added to the version the site already uses, and that a Build Date of October 21, 2026 or later in PHP Info means the fix is applied. No action is needed from clients on Web Hosting, Agency Hosting or cPanel Hosting plans; VPS clients manage PHP themselves. | 2026-10-22 23:17 UTC | |
| BluehostGedeelde hosting / Wereldwijd | Wordt uitgerold | Bluehost says its teams are still deploying patched PHP builds across its remaining hosting infrastructure and that the majority of platforms are now up to date (update stamped Oct 22nd 18:15 est). It tells customers who manage their own VPS or dedicated servers to watch for emails about their services, links guides for changing the PHP version, and lists patched versions per platform (for example cPanel EasyApache 4 PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35). It said on 21 Oct that mitigations stay in place as an extra layer and may limit upload file size. | 2026-10-22 23:17 UTC | |
| GoDaddyGedeelde hosting / Wereldwijd | Gepatcht | GoDaddy says (update of 22 Oct, 13:30 UTC) it has patched all PHP versions on Web Hosting; earlier updates said the same for Managed Hosting for WordPress and Windows Hosting, and customers need take no action on those. VPS owners must update PHP themselves. Its status incident 'Hosting Maintenance' was resolved at 15:07 UTC on 22 Oct. It calls this an industry-wide issue. Its blog's 22 Oct 17:15 UTC update adds that on Web Hosting the PHP version number may not change after the update (a site can still show a version like 8.5.11, because the fix was deployed as a new build with the same version number), so check the build date instead. A status post of 22 Oct 21:06 UTC (state Monitoring) says it has mitigations in place and has patched its managed services, including Web Hosting and Managed Hosting for WordPress. | 2026-10-22 23:17 UTC | |
| HostGatorGedeelde hosting / Wereldwijd | Wordt uitgerold | HostGator says its teams are still deploying patched PHP builds across its remaining hosting infrastructure and that the majority of platforms are now up to date (update stamped Oct 22nd 18:15 est). It tells customers who manage their own VPS or dedicated servers to watch for emails about their services, links guides for changing the PHP version, and lists patched versions per platform (for example cPanel EasyApache 4 PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35). It said on 21 Oct that mitigations stay in place as an extra layer and may limit upload file size. | 2026-10-22 23:17 UTC | |
| DreamHostGedeelde hosting / Wereldwijd | Wordt uitgerold | DreamHost says it put protections in place across all its hosting platforms (shared, VPS, DreamPress and dedicated), that its WAF is blocking exploit attempts, and that, as of 22 Oct 11:12 AM PDT (18:12 UTC), the official PHP security updates have been applied across the entirety of its network, with earlier mitigations staying live and no customer action needed. Its 21 Oct 1:43 PM PDT update said security fixes for PHP 8.1 and older, under its PHP Extended Support program, were expected to roll out within the next day; the later updates do not say whether those fixes were delivered. The incident is still in Monitoring. | 2026-10-22 23:17 UTC | |
| A2 HostingGedeelde hosting / Wereldwijd | Wordt uitgerold | A2 Hosting marked its 'PHP Update' incident resolved on Oct 22, 17:02 CST (about 23:02 UTC), saying the PHP-related service update has been completed successfully; that closing note names no CVE or PHP versions. Its earlier update (Oct 22, 03:09 CST) said patches were being rolled out for all PHP versions from 5.2 and above on cPanel/Plesk shared hosting and managed cPanel/Plesk servers with no customer action needed, and that on its Enhance/Control panel platform patches are installed for all versions from PHP 7.4. For self-managed servers it asks owners to make sure they have applied all vendor updates. It adds that in some cases vendors backported the fixes, so the PHP version number may not have changed, and the phpinfo() build date will show Oct 21st. | 2026-10-22 23:17 UTC | |
| NamecheapGedeelde hosting / Wereldwijd | Gepatcht | Namecheap says its fix was implemented on all servers except Regular servers 71, 105 and 312 (22 Oct, 12:00 PM EDT), and at 12:50 PM EDT (16:50 UTC) that the maintenance has finished; the post is now marked [RESOLVED]. VPS and dedicated server owners must update PHP themselves. A later note (7:00 PM EDT) says you may see PHP 8.5.11 rather than 8.5.12 because its vendor CloudLinux keeps the base version string and backports the security fixes, so that version (for example 8.5.11-5.el8) is expected and contains the fixes for both CVEs. | 2026-10-22 23:17 UTC | |
| InMotion HostingGedeelde hosting / Wereldwijd | Wordt uitgerold | InMotion says (22 Oct, 17:10 UTC) patched PHP packages addressing both CVEs are applied on all Dedicated servers. Shared Hosting is marked complete, with CloudLinux's patched packages 'being applied across our shared hosting servers'. The VPS fleet is still in progress. On shared hosting a patched PHP may keep reporting the old version number (for example 8.3.35 rather than 8.3.36), because CloudLinux patched the existing builds. session.upload_progress.enabled stays disabled as extra hardening, and CWP/CWP Admin ports were restricted while it awaited CWP patches. A later update (22 Oct, 18:31 UTC) says CWP has released version 1.21 and that its teams are pushing the CWP update to dedicated servers, with VPS plans to follow shortly after. | 2026-10-22 23:17 UTC | |
| IONOSGedeelde hosting / Wereldwijd | Gepatcht | IONOS says its websites and hosting are protected: it has already rolled out the official PHP updates across all platforms it operates itself (incident resolved 22 Oct, 06:10 EDT = 10:10 UTC), and customers do not need to take any action. Anyone running PHP themselves, for example on a VPS or dedicated server, should install the update for the latest PHP version immediately. | 2026-10-22 23:17 UTC | |
| OVHcloud Web HostingGedeelde hosting / Europa | Gepatcht | OVHcloud says all PHP releases from 7.4 to 8.5 have been patched on all Web Hosting clusters; it had earlier applied WAF rules on all clusters. It also says it is still working on the previous releases. This covers Web Hosting only, not VPS or Public Cloud. | 2026-10-22 23:17 UTC | |
| KinstaBeheerde WordPress-hosting / Wereldwijd | Gepatcht | Kinsta says all sites are protected and the PHP security updates have been rolled out across the platform (incident resolved 22 Oct, 08:26 UTC). Its earlier updates listed patches for PHP 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 and 8.5 rolling out, and said its Cloudflare firewall mitigations and local configuration changes would stay in place until further notice; the final update does not mention them. | 2026-10-22 23:17 UTC | |
| WP EngineBeheerde WordPress-hosting / Wereldwijd | Gepatcht | WP Engine says it has finished deploying the security patches for the two critical PHP vulnerabilities on its platform, that the patches are applied to each customer's PHP version, and that no action is needed. It names the updated PHP versions 7.4.33.17, 8.2.35, 8.4.27 and 8.5.12. Opgeloste builds volgens de leverancier: php85 8.5.12, php84 8.4.27, php82 8.2.35, php74 7.4.33.17 | 2026-10-22 23:17 UTC | |
| CloudwaysBeheerde WordPress-hosting / Wereldwijd | Gepatcht | Cloudways says the PHP security patch rollout is complete and all active servers have been successfully updated (22 Oct, 10:11 UTC); patches for all customer applications on Autonomous were applied by 01:02 UTC. Its support team is proactively contacting a small subset of customers whose environments need additional assistance. Interim configuration-level mitigations recommended by the PHP Group were deployed earlier; the rollout covered all supported PHP versions including deprecated ones (5.6 and above), and no action was needed from customers. | 2026-10-22 23:17 UTC | |
| PantheonBeheerde WordPress-hosting / Wereldwijd | Wordt uitgerold | Pantheon says patched PHP builds are deployed on all live environments (PHP 8.2 or later, and all LTS versions), all environments in SFTP mode, and all pre-production customer environments. Free/sandbox environments will be updated over the next 24-48 hours. Network-level mitigations stay in place, and Pantheon says no customer action is required. | 2026-10-22 23:17 UTC | |
| WordPress.comBeheerde WordPress-hosting / Wereldwijd | Onbevestigd | Automattic says WordPress.com sites are protected and it worked with the PHP security team; no customer action is stated. | 2026-10-22 23:17 UTC | |
| PressableBeheerde WordPress-hosting / Wereldwijd | Onbevestigd | Pressable says every PHP version on its platform is already protected against both vulnerabilities (production, staging, sandbox); customers need no action. | 2026-10-22 23:17 UTC | |
| FlywheelBeheerde WordPress-hosting / Wereldwijd | Gepatcht | Flywheel says WP Engine has finished deploying the PHP security patches on the Flywheel platform; the patch has been applied to your PHP version and no action is needed. Protective mitigations were also in place at the CDN and host layers. | 2026-10-22 23:17 UTC | |
| NexcessBeheerde WordPress-hosting / Wereldwijd | Wordt uitgerold | Nexcess (a Liquid Web brand) says its engineering teams are continuing to deploy and verify patched PHP builds across its hosting environments and that the rollout is progressing (22 Oct, 10:42 EDT = 14:42 UTC). Its 15:28 EDT (19:28 UTC) update says it is still assessing the remaining environments and will share further updates as patching progresses. On 21 Oct it had said no patches had been rolled out to production yet. | 2026-10-22 23:17 UTC | |
| Liquid WebVPS / cloud / Wereldwijd | Wordt uitgerold | Liquid Web says its engineering teams are actively working to deploy patched PHP builds across its hosting infrastructure. It lists the current patched builds: cPanel PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 plus vendor backports 8.1.34-5, 8.0.30-12 and 7.4.33-19; Plesk (v18.0.81.4) PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, plus end-of-life 8.1, 8.0 and 7.4 builds made on 21 Oct 2026; and Windows Plesk PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It tells customers who are not patched yet to run a package update through their control panel. It does not say its own managed hosting is fully patched. Its 22 Oct 10:33 EDT (14:33 UTC) update lists cPanel EasyApache4 builds (ea-php74 7.4.33-19 to ea-php85 8.5.12) and CloudLinux EasyApache4 builds (for example ea-php85 8.5.11-2, CloudLinux backport builds with lower numbers), and still does not say its managed hosting is fully patched. Its 22 Oct 15:28 EDT (19:28 UTC) update says the work is progressing in stages and that it is still assessing the remaining environments. Opgeloste builds volgens de leverancier: cpanel-php85 8.5.12, cpanel-php84 8.4.27, cpanel-php83 8.3.36, cpanel-php82 8.2.35, cpanel-php81 8.1.34-5, cpanel-php80 8.0.30-12, cpanel-php74 7.4.33-19 | 2026-10-22 23:17 UTC | |
| DigitalOcean App PlatformApp-platform (PaaS) / Wereldwijd | Actie nodig | DigitalOcean says the App Platform PHP buildpack has been patched; you must redeploy your app to pick up the latest buildpack and safe PHP. If you deploy from your own Dockerfile or container image, update the PHP version in that image and redeploy. The post does not name buildpack PHP versions. | 2026-10-22 23:17 UTC | |
| HerokuApp-platform (PaaS) / Wereldwijd | Actie nodig | Heroku released PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on its PHP runtime; you must redeploy your app to pick them up. PHP 8.1.34 on Heroku-22 was rebuilt with the PHP project's backported fix. | 2026-10-22 23:17 UTC | |
| RenderApp-platform (PaaS) / Wereldwijd | Geen melding | No statement about this PHP issue found on Render's official channels as of the check. | 2026-10-22 23:17 UTC | |
| Platform.sh / UpsunApp-platform (PaaS) / Wereldwijd | Wordt uitgerold | Upsun's status page says updated PHP images were deployed to all grid regions across its fleet at 23:35 UTC on 21 Oct and that the PHP security patch finished deploying to all Dedicated clusters at 04:12 UTC on 22 Oct. Its blog (status of 22 Oct, 04:12 UTC) says it has patched every php runtime image from PHP 7.4 to 8.5 (including backported fixes for 7.4, 8.0 and 8.1) and redeployed the affected environments, but the composable image update is still in progress. It strongly recommends customers running PHP versions below 8.x upgrade to PHP 8 as soon as possible; they are protected by its edge-layer mitigations in the meantime. No update will be available for PHP 7.3 or earlier. Brief downtime is possible while containers are refreshed. | 2026-10-22 23:17 UTC | |
| Laravel CloudApp-platform (PaaS) / Wereldwijd | Gepatcht | Laravel Cloud says it has patched every running application with the PHP security release and deployments have resumed. Applications now run PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 depending on the version used, patched in place with no redeploy needed. All new deployments use updated base images that include the patched versions. Opgeloste builds volgens de leverancier: php85 8.5.12, php84 8.4.27, php83 8.3.36, php82 8.2.35 | 2026-10-22 23:17 UTC | |
| Laravel ForgeHostingpaneel / Wereldwijd | Actie nodig | Forge users must still update PHP on their own servers. Laravel's post (updated 21 Oct 23:26 UTC) says that if you use PHP 8.2, 8.3, 8.4 or 8.5 you go to your server in Forge and click 'Update PHP', once per server, or update over SSH if that fails. Servers running Ubuntu 20.04 or older cannot be updated: create a new server on a supported Ubuntu and move your sites. For PHP 8.0 and 8.1 it says no patch is available. Forge's own advisory says its automatic security updates do not patch PHP and that PHP 8.1 and earlier get no official fix. | 2026-10-22 23:17 UTC | |
| AWS Elastic Beanstalk (PHP)App-platform (PaaS) / Wereldwijd | Actie nodig | AWS says its Elastic Beanstalk Amazon Linux 2023 PHP platform versions 4.13.13 now ship PHP 8.5.12 and PHP 8.4.27 (release of 21 Oct 2026) and PHP 8.3.36 and PHP 8.2.35 (release of 22 Oct 2026), which address both CVEs. AWS notes that new platform versions might not yet be available in all AWS Regions and can take a few hours to complete. Environments with Managed Platform Updates enabled get the new platform version automatically in their next maintenance window; otherwise you must update the environment's platform version yourself. Ons advies: Update the environment to platform version 4.13.13 or later on PHP 8.5, 8.4, 8.3 or 8.2 (or enable Managed Platform Updates), and check the platform history for your Region. Opgeloste builds volgens de leverancier: php85 8.5.12, php84 8.4.27, php83 8.3.36, php82 8.2.35 | 2026-10-22 23:17 UTC | |
| Amazon LightsailVPS / cloud / Wereldwijd | Actie nodig | AWS documents how Lightsail owners update PHP themselves. On instances created from the Lightsail-packaged blueprints (WordPress, WordPress Multisite, LAMP and Nginx) PHP comes from the operating system package repositories and is updated with the package manager. Instances created from Bitnami blueprints keep their own copy of PHP that apt upgrade does not update, and AWS recommends moving to a Lightsail-packaged blueprint. AWS lists the fixed versions as 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Ons advies: Take a snapshot, run sudo apt update and sudo apt upgrade, restart the web server, then paste the apt policy or dpkg -l output into this site's Linux package checker (Lightsail's packaged PHP keeps Ubuntu or Debian version numbers, not the upstream ones). For Bitnami-blueprint instances follow AWS's Lightsail guide for moving to a Lightsail-packaged blueprint or replacing the Bitnami PHP. | 2026-10-22 23:17 UTC | |
| Azure App Service (Linux, PHP)App-platform (PaaS) / Wereldwijd | Wordt uitgerold | Microsoft says the updated built-in PHP images are now rolled out to the Latest and Standard release channels for App Service on Linux (PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12). The Extended channel gets the fix last, so it advises switching to Standard or Latest. WordPress apps from the official WordPress on App Service offering in Microsoft Marketplace have been updated to patched PHP, except apps still on the older Alpine-based images, which will not receive the patches. Custom containers must be rebuilt by you, and end-of-life PHP runtimes are not patched. Opgeloste builds volgens de leverancier: php82 8.2.35, php83 8.3.36, php84 8.4.27, php85 8.5.12 | 2026-10-22 23:17 UTC | |
| Google Cloud (App Engine, Cloud Run)Cloudplatform / Wereldwijd | Actie nodig | Google Cloud says App Engine standard (PHP 8.2+) is patched automatically; other services need a redeploy or rebuild with fixed PHP (8.5.12, 8.4.27, 8.3.36, 8.2.35). PHP 8.1 and older will not be patched. | 2026-10-22 23:17 UTC | |
| HetznerVPS / cloud / Europa | Gepatcht | Hetzner says it has deployed patches for PHP 7.4 and 8.0 to 8.5, and then for the remaining PHP versions 5.6 and 7.3, on all Webhosting and Managed Servers. Dedicated and cloud server customers are being notified separately by email. | 2026-10-22 23:17 UTC | |
| netcupGedeelde hosting / Europa | Gepatcht | netcup says all Webhosting packages (including Reseller) and all Managed Servers have been patched and secured and are online, and that no unpatched PHP version is online on them. The Webhosting Control Panel is back online after Plesk provided an updated version. Root server, VPS and managed cloud cluster customers manage their own systems and must patch PHP themselves. | 2026-10-22 23:17 UTC | |
| HostnetGedeelde hosting / Europa | Gepatcht | Hostnet says the PHP security update has been rolled out on all of its systems and the vulnerabilities are fixed, including older PHP versions via PHP Extended Support; its temporary measures were lifted at 00:26 UTC on 22 Oct. A 22 Oct news article says the update was rolled out on the Shared Hosting and Managed VPS platforms; Unmanaged VPS owners manage their own software and are urged to update PHP as soon as possible. | 2026-10-22 23:17 UTC | |
| InfomaniakGedeelde hosting / Europa | Gepatcht | Infomaniak says the PHP security fixes have been deployed on its entire shared Web Hosting and Cloud Server infrastructure for PHP 8.5, 8.4, 8.3, 8.2, 8.1, 8.0 and 7.4 (22/10 07:42, local time as shown on the page). PHP version numbers stay unchanged but the fixes are applied on all the services concerned. Versions older than PHP 7.4 must be upgraded. It disabled session.upload_progress.enabled as a temporary mitigation and temporarily limited file uploads on several of its other services. Its 22/10 17:03 update lists the builds in use (8.5.11, 8.4.26, 8.3.35, 8.2.34, 8.1.34, 8.0.30, 7.4.33), recompiled with the security fixes, and says it will offer 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as soon as possible. | 2026-10-22 23:17 UTC | |
| TransIPGedeelde hosting / Europa | Geen melding | No statement about this PHP issue found on TransIP's official website as of the check. TransIP's status page could not be reached. | 2026-10-22 23:17 UTC | |
| o2switchGedeelde hosting / Europa | Geen melding | No statement about this PHP issue found on o2switch's official channels as of the check. | 2026-10-22 23:17 UTC | |
| GandiGedeelde hosting / Europa | Geen melding | No statement about this PHP issue found on Gandi's official channels as of the check. | 2026-10-22 23:17 UTC | |
| cPanel & WHM (EasyApache 4)Hostingpaneel / Wereldwijd | Gepatcht | EasyApache 4 25.91 (21 Oct 2026) ships fixed ea-php82 to ea-php85 and backported patches for the end-of-life ea-php74, ea-php80 and ea-php81. Install the EasyApache 4 update through the normal system update, then restart PHP (Apache, PHP-FPM or LSAPI) so the new build is loaded. cPanel also updated the PHP inside cPanel & WHM itself (it affects cPanel interfaces, including Roundcube webmail): cPanel & WHM 138.0.18, 136.0.50 and 134.0.66 include PHP 8.4.27, and 110.0.153 includes backported fixes for PHP 8.1.34. On CloudLinux, CloudLinux's own ea-php builds carry the fix under lower version numbers (for example 8.4.26-2.elX.cloudlinux.1), so check the package changelog for the CVE IDs rather than comparing with the numbers above. Opgeloste builds volgens de leverancier: ea-php85 8.5.12-1, ea-php84 8.4.27-1, ea-php83 8.3.36-1, ea-php82 8.2.35-1, ea-php81 8.1.34-5, ea-php80 8.0.30-12, ea-php74 7.4.33-19 | 2026-10-22 23:17 UTC | |
| CloudLinux (alt-php)Hostingpaneel / Wereldwijd | Actie nodig | CloudLinux says fixed alt-php packages are in its stable repositories (release complete 22 Oct 2026, 00:07 UTC): alt-php 5.2-5.6, 7.0-7.4 and 8.0-8.5 on CloudLinux OS 7, 8 and 9; alt-php 5.2, 5.6, 7.0-7.4 and 8.0-8.5 on CloudLinux OS for Ubuntu 22.04; and, on CloudLinux OS 10, alt-php 5.2 (the other versions come from the ELS ALT PHP repository). A regular update now installs all of these, followed by a restart of PHP. The packages carry the fix as a backport and keep their own lower version numbers, so CloudLinux says to confirm the fix in the package changelog. CloudLinux 6 is not confirmed yet. On 22 Oct 14:31 UTC it says fixed alt-php and ea-php packages carry the fix as a backport and so show an older PHP number (it gives alt-php85 8.5.11-5 and, on CloudLinux OS 8, ea-php84 8.4.26-2.el8.cloudlinux.1 as examples); it says alt-php builds with PHP.net version numbers will follow. Its 22 Oct 19:50 UTC update says fixed native PHP packages from the CloudLinux OS repositories are now in the stable channel for every affected version (CloudLinux OS 10: PHP 8.3; OS 9: PHP 8.0, 8.1, 8.2 and 8.3; OS 8: PHP 7.2, 7.3, 7.4, 8.0 and 8.2; OS 7: PHP 5.4 via TuxCare ELS), installed by a regular package update. Ons advies: On CloudLinux OS 7 run yum clean all && yum update "alt-php*"; on CloudLinux OS 8, 9 and 10 run dnf clean all && dnf upgrade "alt-php*"; on CloudLinux OS for Ubuntu run apt-get update && apt-get upgrade. Then restart Apache, PHP-FPM or LiteSpeed, and check the changelog, for example rpm -q --changelog alt-php74-common | grep -E "CVE-2026-(109618|109619)". Security-only updates (yum --security) do not list these packages yet. | 2026-10-22 23:17 UTC | |
| Plesk ObsidianHostingpaneel / Wereldwijd | Actie nodig | Plesk says fixed PHP builds are available: PHP 8.2 to 8.5 as 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on Plesk for Linux and Plesk for Windows. On Linux, the end-of-life PHP 7.4.33, 8.0.30 and 8.1.34 keep their version numbers, and the builds made on 21 Oct 2026 include the fixes. Plesk's own interface engine (sw-engine) is fixed in Plesk Obsidian 18.0.80 Update 11 and 18.0.81 Update 4. Plesk's call to action is to update Plesk to the latest available version. Ons advies: Install the Plesk updates on your server (Plesk's own call to action is to update Plesk), then check the PHP version for each handler under Tools & Settings > PHP Settings. For PHP 7.4, 8.0 and 8.1 on Linux the version number does not change, so check the build date (21 Oct 2026 or later). If your site is on a host's shared server, ask the host whether it has installed the update. | 2026-10-22 23:17 UTC | |
| DirectAdmin (CustomBuild)Hostingpaneel / Wereldwijd | Actie nodig | DirectAdmin released a build on 21 Oct that bumps CustomBuild PHP 8.5, 8.4, 8.3 and 8.2 to the latest versions and adds patches for PHP 8.1, 8.0 and 7.4. A later build adds patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and a small fix for the PHP 8.1 compilation. A further build for the legacy rhel7 and debian10 release channels comes with the latest PHP versions and all security patches, and a newer build for those channels (22 Oct, about 06:18 UTC) fixes the patching order on servers that use LiteSpeed, where patches failed to apply in lsphp mode before. The PHP upgrade is not automatic: run 'da update' then 'da build php' (unless the CustomBuild cron is enabled). Staff earlier noted PHP 8.1 may not build cleanly on some systems. | 2026-10-22 23:17 UTC | |
| Webuzo (Softaculous)Hostingpaneel / Wereldwijd | Actie nodig | Webuzo says it has released updated EMPS packages (the PHP stack Webuzo ships) and end-user PHP that address CVE-2026-109618 and CVE-2026-109619, and that it launched PHP 5.6 to 8.5 with patches (EMPS 5.6 is updated to PHP 7.4 with the patches). It recommends all Webuzo users update EMPS and all PHP as soon as possible by running commands as root (webuzo --emps update, then update each installed PHP, or use Admin Panel -> Update Apps if auto updates were off). Webuzo 4.8.5 (stable, 22 Oct 2026) includes the EMPS security fix and says EMPS will be updated automatically. Webuzo does not name PHP version numbers. | 2026-10-22 23:17 UTC | |
| CyberPanelHostingpaneel / Wereldwijd | Actie nodig | CyberPanel now says fixed LiteSpeed packages are available and that it updated PHP to 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on its own Ubuntu 26.04 test server, where the checks passed. It later added (22 Oct) that its authenticated LiteSpeed Ubuntu 20.04 package index lists fixed-version candidates and that a PHP 8.3 deployment on one Ubuntu 20.04 test host reports PHP and OPcache 8.3.36 (09:50 UTC); it says these results cover only the tested host and branch. Administrators must update every PHP runtime and its modules themselves, refresh CyberPanel's separate panel PHP copy, restart workers and verify. PHP 8.1 and older need a vendor backport or migration. Opgeloste builds volgens de leverancier: php85 8.5.12, php84 8.4.27, php83 8.3.36, php82 8.2.35 | 2026-10-22 23:17 UTC | |
| VirtualminHostingpaneel / Wereldwijd | Alleen workaround | Virtualmin staff say Virtualmin does not provide PHP packages and that the operating system does (forum reply, 21 Oct 19:11 UTC), so the PHP fix comes from your OS or PHP package source. An earlier pre-release staff post suggested turning off one PHP session setting in the PHP-FPM pool as a partial step. No Virtualmin list of patched packages was found. | 2026-10-22 23:17 UTC | |
| ISPConfigHostingpaneel / Wereldwijd | Alleen workaround | ISPConfig says this is not an ISPConfig vulnerability and the real fix is an updated PHP from your distribution or PHP repository (Debian, Ubuntu, sury.org and others). As a temporary measure it published 'ispconfig-multipart-guard', which blocks multipart (file upload) requests in nginx or Apache; uploads on blocked sites stop working until you install the PHP update and switch the guard off. | 2026-10-22 23:17 UTC | |
| aaPanelHostingpaneel / Wereldwijd | Actie nodig | aaPanel staff (post edited 22 Oct 11:07 UTC) say patches are available for PHP 7.4 to 8.5 only (update to 8.5.12, 8.4.27, 8.3.36, 8.2.35, 8.1.35, 8.0.27 or 7.4.34, as the post names them); a staff reply on 22 Oct 01:39 UTC says fixes were added for the 7.4, 8.0 and 8.1 updates. The post now also offers aaPanel self-built patched builds for PHP 7.0, 7.1, 7.2 and 7.3 (7.0.34, 7.1.34, 7.2.35, 7.3.34, installed with a script from node.aapanel.com; aaPanel says to test first); these are aaPanel's own builds, not PHP project releases. Update in the App Store: click 'Update App List', find the PHP version, click Update, and repeat for each installed PHP version; take a snapshot first. Users on PHP 5.6 or older are pointed to configuration mitigation only. Do not judge the 8.1, 8.0 and 7.4 builds by number alone: the post's numbers for those branches are not PHP project fixed releases (php.net's 8.0.27 is an older, unfixed release). Several users in the same thread report failed or very slow PHP builds in the panel. Opgeloste builds volgens de leverancier: php85 8.5.12, php84 8.4.27, php83 8.3.36, php82 8.2.35 | 2026-10-22 23:17 UTC | |
| Cloudflare WAFCDN / WAF / Wereldwijd | Alleen workaround | Cloudflare deployed managed WAF rules for php2shell that are on by default for Free and paid plans (from 21 Oct 2026 03:02 UTC). It also released a new response-side managed rule (Cloudflare Managed Response Firewall Default, 'Default block for High confidence Signatures') on all plans including Free, which looks at the origin's response as well as the request. They are an extra layer only: Cloudflare says to patch PHP anyway, and traffic that reaches your server without passing through Cloudflare is not covered. Paid plans should check that the Managed Ruleset is deployed in block mode. | 2026-10-22 23:17 UTC | |
| Sucuri Website FirewallCDN / WAF / Wereldwijd | Alleen workaround | Sucuri has deployed extra WAF rules for the two PHP CVEs on its Website Firewall (status: 'Monitoring', 21 Oct 2026 15:14 UTC). A Sucuri blog post (21 Oct, 21:12 UTC) adds that more refined virtual patching rules for known exploitation paths are now deployed across its WAF network, that the WAF only works for requests passing through the firewall (direct connections to the origin can bypass it), and that you must still update PHP. Sucuri stresses this does not replace patching PHP on the origin server: ask your host to update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or a vendor-patched package. | 2026-10-22 23:17 UTC | |
| Wordfence (WordPress)CDN / WAF / Wereldwijd | Actie nodig | Wordfence published a post-release notice: PHP has released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix both vulnerabilities, WordPress automatic updates will not fix them, and PHP must be updated by your host or on your own server. A follow-up post (22 Oct 00:51 UTC) says its Threat Intelligence team reviewed PHP's patches and tested the behaviour in lab environments, that its firewall protects the WordPress application layer only, and that updating and restarting PHP is essential. It does not announce a firewall rule for these CVEs. | 2026-10-22 23:17 UTC | |
| Patchstack (WordPress)CDN / WAF / Wereldwijd | Actie nodig | Patchstack's alert (21 Oct 2026) says to update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor's patched package) and to contact your vendor for a backport or upgrade if you run PHP 8.1 or older. It lists configuration measures as partial only and recommends against unofficial 'fix' plugins. The page does not mention a Patchstack virtual patch for this issue. | 2026-10-22 23:17 UTC | |
| Imunify360 (CloudLinux)CDN / WAF / Wereldwijd | Alleen workaround | Imunify360's WAF rules are an interim mitigation, not a fix. Rulesets 8.83 to 8.85 (21 Oct) are delivered automatically to servers with Imunify360 and its WAF enabled; on Apache, Nginx and Coraza they block the known exploit requests and the public exploit tool, and since ruleset 8.84 LiteSpeed also blocks the tool and upload-progress requests that do not come from the site's own pages. Imunify360 also gives scanning IPs a CAPTCHA challenge. CloudLinux says the rules target only the upload-progress path of CVE-2026-109619 and that no rule blocks the out-of-memory path of CVE-2026-109618 yet; ImunifyAV and servers with the WAF disabled get no coverage. Updating PHP is still the action to take: CloudLinux's blog (22 Oct 01:25 UTC) says fixed alt-php packages are now in stable. | 2026-10-22 23:17 UTC | |
| さくらのレンタルサーバ / さくらのマネージドサーバ (Sakura Internet)Gedeelde hosting / Japan | Gepatcht | Sakura Internet says it has completed the fix for the PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) for every PHP version that can be selected in the control panel, for Rental Server and Managed Server. Its emergency maintenance 'PHP version upgrade' is marked completed at 2026-10-22 06:30 JST. Its notice still says phpMyAdmin and webmail were being handled (webmail added as complete at 13:45 JST), while its maintenance entry for the partial-function stop shows webmail, old webmail and File Manager restored at 13:45 JST and phpMyAdmin at 15:15 JST. Ons advies: Sakura says no urgent action is needed from customers. It also suggests moving to the newest PHP version still in its support period; if you do, check that your app works on it and take a backup first. | 2026-10-22 23:17 UTC | |
| エックスサーバー (Xserver)Gedeelde hosting / Japan | Wordt uitgerold | Xserver Inc.'s official X account says (post of 21:14 JST on 22 Oct) that fix patches have been applied on all target servers for PHP 5.6 to 8.5, and that it is still creating and verifying patches for PHP 5.5 and older. Earlier posts said the same for PHP 7.4 to 8.1 (12:08 JST). It also says the service sites resumed in sequence from 20:10 JST, with some functions still under maintenance. Ons advies: The notice does not ask customers to do anything now. Xserver says it may ask customers for additional steps depending on how they use the service and will announce them separately, so check the host's notice (site and X @xserverjp) and act only if it asks. If you run PHP 5.5 or older, check with the host before relying on it. | 2026-10-22 23:17 UTC | |
| Xserverビジネス (Xserver Business)Gedeelde hosting / Japan | Wordt uitgerold | Xserver Inc.'s official X account says (post of 21:14 JST on 22 Oct) that fix patches have been applied on all target servers for PHP 5.6 to 8.5, and that it is still creating and verifying patches for PHP 5.5 and older. Earlier posts said the same for PHP 7.4 to 8.1 (12:08 JST). It also says the service sites resumed in sequence from 20:10 JST, with some functions still under maintenance. The company-wide notice does not name Xserver Business. Ons advies: The notice does not ask customers to do anything now. Xserver says it may ask customers for additional steps depending on how they use the service and will announce them separately, so check the host's notice (site and X @xserverjp) and act only if it asks. If you run PHP 5.5 or older, check with the host before relying on it. | 2026-10-22 23:17 UTC | |
| シンレンタルサーバー (Shin Rental Server)Gedeelde hosting / Japan | Wordt uitgerold | Xserver Inc.'s official X account says (post of 21:14 JST on 22 Oct) that fix patches have been applied on all target servers for PHP 5.6 to 8.5, and that it is still creating and verifying patches for PHP 5.5 and older. Earlier posts said the same for PHP 7.4 to 8.1 (12:08 JST). It also says the service sites resumed in sequence from 20:10 JST, with some functions still under maintenance. The company-wide notice does not name Shin Rental Server. Ons advies: The notice does not ask customers to do anything now. Xserver says it may ask customers for additional steps depending on how they use the service and will announce them separately, so check the host's notice (site and X @xserverjp) and act only if it asks. If you run PHP 5.5 or older, check with the host before relying on it. | 2026-10-22 23:17 UTC | |
| スターレンタルサーバー / スターサーバー (Star Server)Gedeelde hosting / Japan | Wordt uitgerold | Xserver Inc.'s official X account says (post of 21:14 JST on 22 Oct) that fix patches have been applied on all target servers for PHP 5.6 to 8.5, and that it is still creating and verifying patches for PHP 5.5 and older. Earlier posts said the same for PHP 7.4 to 8.1 (12:08 JST). It also says the service sites resumed in sequence from 20:10 JST, with some functions still under maintenance. The company-wide notice does not name Star Rental Server. Ons advies: The notice does not ask customers to do anything now. Xserver says it may ask customers for additional steps depending on how they use the service and will announce them separately, so check the host's notice (site and X @xserverjp) and act only if it asks. If you run PHP 5.5 or older, check with the host before relying on it. | 2026-10-22 23:17 UTC | |
| ロリポップ！レンタルサーバー (GMO Pepabo)Gedeelde hosting / Japan | Gepatcht | GMO Pepabo says on its official X account that it applied the fixed version and restored customers' sites at 13:11 JST on 22 Oct, and that it also applied its own fixes to older PHP versions that have no official fix. Its recovery notice (16:27 JST) names CVE-2026-109618 / CVE-2026-109619 and says the fix application is complete and customers' sites resumed around 13:00. It says it stopped customers' sites server by server to protect all sites, including those not on PHP 8.2 or later. The service site, apart from some parts, is to resume shortly. Ons advies: Lolipop's recovery notice (official X, 16:27 JST) asks customers to move to PHP 8.2 or later, to check that WordPress core, plugins and themes are up to date, and to check that the site, forms and file uploads work. Watch @lolipopjp for when the service site is fully back. | 2026-10-22 17:17 UTC | |
| ヘテムル (heteml, GMO Pepabo)Gedeelde hosting / Japan | Gepatcht | GMO Pepabo says in its final report (22 Oct) that the fix is applied on every PHP version: the upstream fixed builds 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 on PHP 8.2 to 8.5, the upstream patch for the end-of-life PHP 7.4 / 8.0 / 8.1, and its own fixes for PHP 5.6 to 7.3. It says customer sites resumed at 11:24 JST and, as of its 18:05 JST addendum, all services are back. It also says the session.upload_progress feature is disabled on all versions and asks customers to check their sites. Ons advies: Check that your own site still works: the host says the session.upload_progress feature is disabled on all PHP versions. It also suggests moving to PHP 8.2 or later, which is still supported upstream; PHP 8.1 and older fixes are stopgaps. Opgeloste builds volgens de leverancier: php8.2 8.2.35, php8.3 8.3.36, php8.4 8.4.27, php8.5 8.5.12 | 2026-10-22 23:17 UTC | |
| レンタルサーバーCPIGedeelde hosting / Japan | Wordt uitgerold | CPI's notice page says it is urgently working on the PHP versions for which the latest official patch exists, and will update on versions without a patch; the patch application status is to be announced later on the same page. Customer servers keep running and sites and mail work as usual. The service site (21:00 JST on 22 Oct), control panel (about 17:00), My Page (about 16:00) and Roundcube webmail (about 13:11) have resumed; the secure file manager is expected from 30 Oct or later. It states no unauthorized access or attack has been observed. For PHP versions the patch cannot be applied to, it describes php.ini changes as a risk-reduction step and says it does not support php.ini changes. Ons advies: No customer action is requested. Sites and mail keep working. For PHP versions the patch cannot be applied to, CPI describes php.ini settings as a risk-reduction step (not supported by CPI). Watch CPI's notice page for the patch status. | 2026-10-22 23:17 UTC | |
| KAGOYA レンタルサーバー (カゴヤ・ジャパン)Gedeelde hosting / Japan | Wordt uitgerold | KAGOYA's notice naming CVE-2026-109618 / CVE-2026-109619 (newest update on 22 Oct, page modified 18:48 JST) says that for Rental Server plans (PHP 7.4, 8.1, 8.2, 8.3, 8.4, 8.5) it is updating to the fixed versions in sequence and expects to finish at 24:00 on 22 Oct. For Managed Dedicated, Shared Server and WordPress-dedicated plans it says the permanent response is still being decided, and as an interim risk reduction it asks owners to consider taking the site offline (switching to a maintenance screen) or restricting access. Ons advies: On the Rental Server plan, KAGOYA is already updating; wait for it to finish and watch the same notice page. On Managed Dedicated, Shared Server and WordPress-dedicated plans KAGOYA suggests interim steps such as taking the site offline or restricting access (its notice shows an .htaccess example). | 2026-10-22 23:17 UTC | |
| ConoHa WING (GMO Internet)Gedeelde hosting / Japan | Gepatcht | ConoHa says in its final report (official X, posted 21:01 JST on 22 Oct) that all its response to the PHP vulnerability is complete: as of 20:45 JST on 22 Oct the security patches have been applied to its servers. Its earlier report (18:00 JST) had said patching was still in sequence, with Webmail and File Manager resumed and phpMyAdmin still suspended. Ons advies: ConoHa says you do not need to change your PHP version yourself. It applied the patches inside each PHP version rather than upgrading it, so a tool such as WordPress Site Health may still show the older version number (for example 8.5.11); the host says this is expected. | 2026-10-22 17:17 UTC | |
| お名前.com レンタルサーバー (GMO Internet)Gedeelde hosting / Japan | Wordt uitgerold | GMO Internet says its emergency server maintenance since 2026-10-21 and the temporary suspension of File Manager, phpMyAdmin and Webmail are part of its response to the fixed version of PHP released on 2026-10-21 (23:00 JST). It says it is applying security patches to servers in sequence while keeping each customer's current PHP version. Customers basically do not need to change their PHP version, but it says a change may be needed for some customers on PHP 5.x or 7.x. Website display and mail work as usual. Ons advies: Basically no PHP version change is needed. If you are on PHP 5.x or 7.x, check the host's notices, because a change may be needed. File Manager, phpMyAdmin and Webmail are suspended as a precaution. | 2026-10-22 17:17 UTC | |
| カラフルボックス / カラフルビジネス (ColorfulBox)Gedeelde hosting / Japan | Gepatcht | ColorfulBox says that protective measures and the security-fix update work on all its servers (shared server, ColorfulBusiness, Tada Server, dedicated server) were all completed by the morning of 2026-10-22. It says the servers were updated to fixed builds while keeping each customer's PHP version, so customers do not need to change or switch PHP versions. It says older versions such as PHP 7.4 and PHP 8.0/8.1 are also covered by security fixes and protective measures on the server side, in addition to the latest fixed releases of PHP 8.2 to 8.5. Ons advies: ColorfulBox says no action is needed and that you do not need to change your PHP version. | 2026-10-22 23:17 UTC | |
| mixhost (ミックスホスト)Gedeelde hosting / Japan | Gepatcht | mixhost says that at about 10:18 JST on 2026-10-22 it finished applying the PHP fix packages on all servers of mixhost Rental Server, mixhost Adult Rental Server and mixhost Overseas Rental Server, for CVE-2026-109618 and CVE-2026-109619. It says the scope is PHP 5.2 to 8.5, including versions that upstream no longer fixes, through CloudLinux's own fix packages. The fix does not change the PHP version number shown (for example 8.4.26 stays 8.4.26). It says no customer action is needed and recommends PHP 8.2 or later for customers on older versions. Ons advies: mixhost says no customer action is needed. The PHP version number shown in WordPress Site Health or phpinfo does not change after the fix. If you are on PHP below 8.2, it recommends moving to 8.2 or later. | 2026-10-22 23:17 UTC | |
| CORESERVER V1 / V2 (コアサーバー, Value Domain)Gedeelde hosting / Japan | Gepatcht | Value Domain's status page names CVE-2026-109618 / CVE-2026-109619 and marks both CORESERVER maintenances completed. For CORESERVER V1 (all servers, completed 00:50 JST on 22 Oct) it says the fix is complete for every PHP version it offers (PHP 5.3 to 8.5), and for CORESERVER V2 (all servers, completed 11:13 JST) for every PHP version it offers (PHP 5.2 to 8.5). It says customers do not need to change their PHP version. Ons advies: Value Domain says no PHP version change is needed on your side. | 2026-10-22 23:17 UTC | |
| XREA (エクスリア, Value Domain)Gedeelde hosting / Japan | Gepatcht | Value Domain's status page names CVE-2026-109618 / CVE-2026-109619 and marks the XREA maintenance (all servers, completed 00:50 JST on 22 Oct) completed. It says the fix is complete for every PHP version it offers (PHP 5.3 to 8.5) and that customers do not need to change their PHP version. Ons advies: Value Domain says no PHP version change is needed on your side. | 2026-10-22 23:17 UTC | |
| VALUESERVER (バリューサーバー, Value Domain)Gedeelde hosting / Japan | Gepatcht | Value Domain's status page names CVE-2026-109618 / CVE-2026-109619 and marks the VALUESERVER maintenance (all servers, completed 00:50 JST on 22 Oct) completed. It says the fix is complete for every PHP version it offers (PHP 5.3 to 8.5) and that customers do not need to change their PHP version. Ons advies: Value Domain says no PHP version change is needed on your side. | 2026-10-22 23:17 UTC | |
| Oneレンタルサーバー (Value Domain / GMO DigiRock)Gedeelde hosting / Japan | Gepatcht | Value Domain's status page names CVE-2026-109618 / CVE-2026-109619 and marks the One Rental Server (Oneレンタルサーバー) maintenance (all servers, completed 10:20 JST on 22 Oct) completed. It says the fix is complete for every PHP version it offers (PHP 5.6 to 8.5) and that customers do not need to change their PHP version. Ons advies: Value Domain says no PHP version change is needed on your side. | 2026-10-22 23:17 UTC | |
| WebARENA (NTTPC)Gedeelde hosting / Japan | Alleen workaround | NTTPC's notice for WebARENA SuiteX / SuiteS (2026-10-22 update) names CVE-2026-109618 and CVE-2026-109619. After first restricting web access from outside Japan, it is also stopping web access from inside Japan in sequence: from 18:00 JST on 22 Oct for SuiteX and from 17:30 JST on 22 Oct for SuiteS. For SuiteX it says PHP 8.3 will be upgraded to 8.3.36 on 22 Oct without a web stop, PHP 7.4 on servers opened from 19 Nov 2025 will be swapped for PHP 8.3 and rolled back to a patched PHP 7.4 from 23 Oct, and servers opened on or before 18 Nov 2025 (PHP 7.4 / 7.2 / 5.6 / 5.3 / 5.1) cannot be patched, so web access stays stopped until an effective fix is possible. For SuiteS it says PHP 7.2 / 5.6 / 5.3 / 5.1 cannot be patched, so web access stays stopped until an effective fix is possible. The customer contract management screen is stopped with no date set. The notice does not say a PHP fix has already been applied. Ons advies: WebARENA says that PHP 7.4 on servers opened from 19 Nov 2025 will be switched to PHP 8.3 on 22 Oct, so some content may not display correctly. Web pages, management tools, phpMyAdmin, webmail and the contract management screen are being stopped as described in its notice; FTP stays available. Watch the same notice page for restart timing and fee relief. | 2026-10-22 23:17 UTC | |
| ABLENET (旧ケイアンドケイコーポレーション)VPS / cloud / Japan | Geen melding | No PHP-specific statement found. The latest security item (2026-10-20) is about the Linux kernel CVE-2026-99999 for VPS, a different issue. Ons advies: No instruction. If you run PHP yourself, update the OS package and check the version. | 2026-10-22 23:17 UTC |