How to read this. Statuses come from each provider's own public statements, collected on 22 October 2026. We have not tested any servers. A "no statement found" row means we found nothing public, not that the host is unpatched. Statuses change hourly, so check the provider's status page before you act. For what the flaw is and how to patch a server you manage, see our PHP2SHELL explainer.
What the statuses mean
- Patched
- The host says a fixed PHP build is deployed across the relevant plans.
- Patching
- A rollout is announced and under way.
- Partial
- Some plans are done and others are pending or left to the customer.
- Mitigation only
- A firewall rule or similar is in place, but no patched build is confirmed.
- No statement found
- We found nothing public as of the snapshot. This is not evidence of being unpatched.
Managed web and WordPress hosts
| Provider | Type | Status | Reported (22 Oct 2026) |
|---|---|---|---|
| Kinsta | WordPress | Patched | 08:26 UTC, status incident |
| Flywheel | WordPress | Patched | 21 Oct 19:00 UTC, status page |
| Cloudways | Managed cloud | Patched | 10:20 UTC, status page |
| Pressable | WordPress | Patchedhost's wording, no build named | 21 Oct, status post |
| WordPress.com / VIP / WP Cloud | WordPress | Patchedhost's wording, no build named | 21 Oct, Automattic posts |
| WP Engine | WordPress | Partialsourced secondarily | 01:19 UTC |
| Hostinger | Web | Partialnon-VPS patched | 07:20 UTC, blog |
| GoDaddy | Web | PartialWeb Hosting patched; VPS self-managed | 13:30 UTC, news post |
| InMotion | Web | Partialshared mitigated | 21 Oct 14:40 UTC, status page |
| Pantheon | Platform | Partialsandbox pending | 02:08 UTC, status incident |
| Hetzner | Managed / EU | Partialolder branches added later | 04:32 UTC, status incident |
| OVHcloud | Web / cloud / EU | Partialpre-7.4 still in progress | 14:12 UTC, status incident |
| SiteGround | Web | Mitigation only | 21 Oct 11:30 UTC, blog |
| Bluehost | Web | Patching | 22 Oct, announcement |
| DreamHost | Web | Patchingfinal staging tests | 11:24 UTC, status incident |
| Liquid Web | Web | Patching | 14:33 UTC, status incident |
| Namecheap | Web | Patchinga few servers left | 13:33 UTC, status update |
| Rocket.net | WordPress | Patching | 10:36 UTC, status incident |
| HostGator | Web | No statement found | — |
| Nexcess | Web | No statement found | — |
| A2 Hosting | Web | No statement found | — |
Cloud and platform providers
On raw compute, the provider patches its own managed runtimes and you patch anything you run yourself. That split is the normal design, so read "you patch" as a division of labour, not a gap.
| Provider | What they patch | What you patch |
|---|---|---|
| AWS | Elastic Beanstalk managed platform | Lightsail, EC2, your own Amazon Linux instances |
| Google Cloud | App Engine standard environment | Cloud Run, Cloud Functions, instances you redeploy |
| Microsoft Azure | Built-in Linux App Service images | Custom container images |
| DigitalOcean | App Platform (via redeploy) | Droplets, 1-Click PHP images |
| Vercel | WAF rules only | Your PHP runtime |
| Webflow | States it is not affected | — |
| Netlify | No statement found | — |
Email hosts
The patch-status trackers list no dedicated email hosts, and for good reason. Mailbox providers such as Google Workspace, Microsoft 365, Zoho Mail, Fastmail, and Proton do not run your PHP. Their own web surfaces are theirs to patch, the same as any operator, but there is nothing for a mailbox customer to do about PHP2SHELL on that account. If you run a mail-adjacent PHP app, such as a webmail front end or a contact-form handler on your own hosting, that falls under your web hosting, not your mailbox provider.
Control panels and operating systems
If your host uses a control panel, the PHP it serves is patched through that panel or the underlying distribution:
- cPanel, Plesk, DirectAdmin: check the panel's PHP package changelog for the CVE, or wait for the panel's updated builds.
- CloudLinux: ships hardened PHP builds and typically patches quickly through its own channel.
- Debian, Ubuntu, RHEL and rebuilds: the patch arrives as a package update that keeps the old version number. Debian 11 "bullseye" is a known gap, because its free support window closed, so a bullseye host on PHP 7.4 may have no free patch coming.
What this means for you
- On managed hosting: find your host above, then confirm on its status page. If it is still "patching," your site may not be covered yet. Ask.
- On unmanaged hosting or your own cloud instance: this is yours to patch. See our explainer for the steps.
- If your host has no public statement: that is not evidence either way. Open a ticket and ask whether the 21 October PHP security release is deployed.
Sources
Provider status pages and blogs, aggregated with a third-party status tracker and checked against primary sources where possible; vulnerability facts from the PHP project release and from Sansec, watchTowr, and Cloudflare. Statuses are self-reported and were collected on 22 October 2026. We will update this page as hosts post more.
By W. Miller · Editor, Digital Hosting ·