Has my hosting provider patched PHP2Shell?

On shared and managed hosting, your host updates PHP, not you. This table lists what each provider has said publicly, with a link to its statement. We only count the provider's own pages.

Statements last checked on . If your host isn't listed or has said nothing, ask them with the message below. Not sure which host a site uses? Check the site and the result names the provider.

Hosting providerTypeStatusDetails
SiteGroundShared hostingSays it's patchedThe host says its servers run the fixed PHP. Read the statement
HostingerShared hostingPublished a noticeRead the notice to see which plans it covers. Read the statement
InMotion HostingShared hostingPublished a noticeRead the notice to see which plans it covers. Read the statement
GoDaddyShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
Newfold Digital (Bluehost, HostGator)Shared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
NamecheapShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
IONOSShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
DreamHostShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
A2 HostingShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
StratoShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
ArubaShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
LWSShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
o2switchShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
ROMARGShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
HostVisionShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
HosticoShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
ClausWebShared hostingNo statement foundWe found no public statement. Ask the host to confirm in writing.
WP EngineManaged WordPressNo statement foundWe found no public statement. Ask the host to confirm in writing.
KinstaManaged WordPressNo statement foundWe found no public statement. Ask the host to confirm in writing.
OVHcloudShared hosting and serversNo statement foundWe found no public statement. Ask the host to confirm in writing.
HetznerShared hosting and serversNo statement foundWe found no public statement. Ask the host to confirm in writing.
Amazon Web ServicesCloud and VPSYou update PHPOn servers you run yourself, the provider doesn't update PHP. Its managed platforms are updated by the provider.
Google CloudCloud and VPSYou update PHPOn servers you run yourself, the provider doesn't update PHP. Its managed platforms are updated by the provider.
Microsoft AzureCloud and VPSYou update PHPOn servers you run yourself, the provider doesn't update PHP. Its managed platforms are updated by the provider.
DigitalOceanCloud and VPSYou update PHPOn servers you run yourself, the provider doesn't update PHP. Its managed platforms are updated by the provider.
Linode (Akamai)Cloud and VPSYou update PHPOn servers you run yourself, the provider doesn't update PHP. Its managed platforms are updated by the provider.
VultrCloud and VPSYou update PHPOn servers you run yourself, the provider doesn't update PHP. Its managed platforms are updated by the provider.
ContaboCloud and VPSYou update PHPOn servers you run yourself, the provider doesn't update PHP. Its managed platforms are updated by the provider.
ScalewayCloud and VPSYou update PHPOn servers you run yourself, the provider doesn't update PHP. Its managed platforms are updated by the provider.
Alibaba CloudCloud and VPSYou update PHPOn servers you run yourself, the provider doesn't update PHP. Its managed platforms are updated by the provider.
M247Cloud and VPSYou update PHPOn servers you run yourself, the provider doesn't update PHP. Its managed platforms are updated by the provider.

How to ask your host

Send this to your host's support. It asks for the one thing that matters: whether the PHP actually running your site includes the fix.

Hello,

My site your-site.com is hosted with you. Can you confirm in writing whether the PHP version running it includes the fixes for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or a distribution package with the fix backported. If my site runs PHP 8.1 or older, what are my options for moving to a supported version?

Thank you,

Control panels and firewalls

Some fixes come from the software your host runs rather than from the host itself.