GoDaddy PHP2Shell status: is your hosting patched?

GoDaddy says it has patched PHP for the PHP2Shell bugs (CVE-2026-109618 and CVE-2026-109619) on Web Hosting, Managed Hosting for WordPress and Windows Hosting, with Web Hosting logged at 22 October 2026, 13:30 UTC. VPS customers must update PHP themselves. On Web Hosting the version number may not change, so check the build date, then ask support to confirm your domain.

All GoDaddy rows are GoDaddy's own statements about its own service. We have not been able to test them from outside.

What does GoDaddy say about PHP2Shell?

GoDaddy published a page called "Important PHP security update: what website owners need to do". Its header carries 20 October 2026, the day before the fix, and GoDaddy has kept adding dated entries to it. This is the log as it stood at our check on 26 October 2026. All times are UTC.

Earlier on 21 October, GoDaddy told customers on Web Hosting and Windows Hosting that it had put mitigations in place while it waited for packages from its vendor. The PHP project says mitigations reduce exposure but updating is the only complete fix.

Why can a patched GoDaddy site still show an old PHP version?

GoDaddy says its Web Hosting fix was built into the previous release and shipped with the same version number. A site can report 8.5.11 or 8.2.34 and still carry the fix. GoDaddy says patched packages have a build date of 21 October 2026 or later.

The PHP selector shows the branch you chose, such as 8.4, and does not show the build. A version string alone proves nothing in either direction.

Two more caveats:

• CLI is not web. php -v in a terminal can be a different binary from the one answering web requests. Check the build date of the runtime that serves your domain.
• A backport is not an upgrade. If you are stuck on an old branch, what to do about PHP 8.1 and older is its own page. GoDaddy says cPanel backported the fix to PHP 7.4, 8.0 and 8.1, and still recommends 8.2 or later. The PHP project ships no new release for 8.1 and older, only minimal source backports.

How do I confirm my GoDaddy site's PHP is patched?

How do I check a GoDaddy Web Hosting (cPanel) site?

To see which PHP branch you selected, follow GoDaddy's help steps: open your GoDaddy product page, choose Manage next to Web Hosting, open cPanel Admin, then Select PHP Version under Software.

That tells you the branch. To read the build, GoDaddy says to run php -v over SSH and read the date after "built:", or to load a temporary phpinfo page and read "Build Date", then delete the page. Treat the SSH result with care for the CLI reason above. Then send support this:

For [your domain], is the PHP runtime that serves web requests patched for CVE-2026-109618 and CVE-2026-109619? Please give the fixed build or backport identifier, confirm that all PHP workers serving it have been restarted or replaced, and say whether I need to change a setting.

• Selected PHP branch is 8.2 or later (GoDaddy's recommendation)
• Build date is 21 October 2026 or later
• Support has confirmed your domain in writing
• Any temporary phpinfo page is deleted

What do I do on a GoDaddy VPS?

GoDaddy says VPS customers update PHP themselves, or ask its Expert Services team. For cPanel/WHM servers it points to the patched ea-php packages in EasyApache 4. GoDaddy's order is backup, update, restart PHP and the web server, then verify.

• Back up or snapshot the site and server first, so you can roll back
• Update PHP from your distribution or EasyApache, and check the package changelog names both CVEs
• Restart PHP and the web server (PHP-FPM or Apache) so running workers use the new code (how the restart works)
• Rebuild and redeploy any container image that bundles PHP
• Verify with php -v and check each virtual host if the server runs more than one PHP version. A version string alone is not proof of the fix

For how other hosts word the same thing, see Is SiteGround patched for PHP2Shell?, or the other host status pages. On a cPanel/WHM server, updating PHP through cPanel is covered step by step. The fixed releases for every branch are in the fixed versions table.

Am I affected? A three-state self-test

Was anything exploited before GoDaddy patched?

AWS reported exploit attempts against its honeypots from 17 October 2026, four days before disclosure, and more once public proof-of-concept code appeared on 21 October. AWS says it is unclear whether those attempts would have succeeded on real systems. We found no primary source naming a confirmed compromise of a GoDaddy-hosted site. Web Hosting was logged as patched at 22 October 13:30 UTC. Between disclosure and that time, GoDaddy says mitigations were in place. If your site ran on Web Hosting in that window, look for PHP files you did not create in upload directories, unfamiliar cron entries, new administrator accounts and odd outbound connections from the web server. Patching does not remove anything planted before it. See Is PHP2Shell being exploited? for the evidence as it stands.

What kind of bug is PHP2Shell?

The PHP project says both CVEs can allow unauthenticated remote code execution. CVE-2026-109618 is remote code execution after an out-of-memory error leaves request memory in an invalid state. The CVE-2026-109619 advisory describes its own conditions. This page leaves out how to trigger the bugs, and you do not need that to fix a site. A plainer walk through what the two CVEs mean is separate. The full picture is in the complete PHP2Shell write-up, and the wider run of incidents is in the October 2026 tracker.

PHP also posted a 23 October informational notice about session upload progress and named CVE-2026-115560, with a full advisory promised for the next release. That is separate from these two CVEs.