On this page
HostGator's status page says it is deploying patched PHP builds for CVE-2026-109618 and CVE-2026-109619, and that most platforms are updated, as of its 23 October 2026 update (HostGator status). CVE-2026-109618 and CVE-2026-109619 are the two PHP CVEs behind PHP2Shell (PHP notice). That is a fleet statement, not proof for your domain. Ask support to confirm the fixed build for your account and the worker restart time.
| Fact | Detail | Source |
|---|---|---|
| CVE ids | CVE-2026-109618 and CVE-2026-109619, remote code execution in PHP | PHP notice |
| Severity | CVSS v4 9.2 for both, per PHP's pre-announcement | PHP notice |
| Upstream fixed releases | 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35 | PHP notice, changelog |
| HostGator notice | "PHP Update", posted 21 October 2026, last updated 23 October 2026 20:55 EST (the page's own time label). Cites both CVEs, lists patched builds by platform | HostGator status |
| HostGator's stated progress | Patched builds being deployed across its infrastructure; most platforms updated | HostGator status |
| Your domain | Not stated by anyone but HostGator support. Unknown until you ask | this page |
| Exploitation | Honeypot attempts from 17 October (AWS, vendor-claimed) | AWS |
| Checked | At our check on 26 October 2026 | this page |
What does HostGator's own page say?
We read HostGator's notice at our check on 26 October 2026 (HostGator status). It was posted on 21 October and updated several times since, the latest on 23 October. At our check it said:
- It cites CVE-2026-109618 and CVE-2026-109619. It does not use the name PHP2Shell (HostGator status).
- HostGator's teams are deploying patched PHP builds across its hosting infrastructure, and most platforms are now updated (HostGator status).
- Its newest entry, 23 October 20:55 EST, adds a separate PHP CVE, CVE-2026-115560, which HostGator says affects only an uncommon session configuration, with no known exploitation. It says no action is needed for managed hosting customers (HostGator status).
- It lists patched builds by platform, including cPanel EasyApache 4, Plesk, CloudLinux, AlmaLinux, Rocky Linux, CentOS Stream, Fedora, Ubuntu and Debian (HostGator status).
- Its 22 October 11:00 EST entry tells customers who manage their own VPS or dedicated server to run a package update through their control panel. Its later entries, including the 23 October one, tell those customers to watch for emails about services (HostGator status).
- The same 22 October entry says anyone who receives a notification email should follow its instructions as soon as possible (HostGator status).
- The same entry points customers to HostGator's Customer Portal PHP Info article, which describes opening the PHP Info view for a site (HostGator status).
"Most platforms" is HostGator's wording about its own fleet. It does not list which servers are done, and it does not say your account's server is among them. Treat it as vendor-claimed and partial. The page is the first thing to read, and it moves, so open it again before you act.
Who needs to act on HostGator?
HostGator's notice distinguishes customers by who manages the server and whether it is already on a patched version. It does not name hosting plans (HostGator status).
| Your situation | What the notice says | Your action |
|---|---|---|
| Your server is on a patched version of PHP | The 22 October entry says no action is needed on a patched version, and that HostGator is applying patches. It does not say which plans that covers | Ask support whether your server is on a patched version (question below). Follow any email from HostGator, which the notice says it sends where action is needed |
| You manage your own VPS or dedicated server | The 22 October entry asks for a package update through your control panel. The latest entries say to watch for emails about services | Follow any email from HostGator. Update the PHP packages and restart the PHP services |
| A manually pinned PHP version | The notice does not address pinning | Confirm the pinned branch has the fix, not just that the selector shows it |
If you do not know who manages your server, support can tell you. The email template for shared hosting works for any host.
Why is the PHP version in the panel not an answer?
The HostGator help article gives two places to see and change PHP: Customer Portal → Websites → Manage Site → Advanced → PHP Version, or cPanel → Software → MultiPHP Manager (HostGator help, at our check on 26 October 2026). Both show a branch such as 8.3. Neither shows whether that branch contains the fix.
Two reasons the number misleads:
- Backports keep the old number. Vendors ship fixes as new package builds. CloudLinux, which supplies the cPanel EasyApache and alt-php packages used on many cPanel hosts, says fixed ea-php52 to ea-php85 packages reached stable from 21 October, and that builds with php.net numbering such as 8.3.36-1 followed on 23 October (CloudLinux). Its post does not mention HostGator, so it does not tell us which packages your server runs.
- The command line is not the web. PHP's notice scopes the risk to installations serving web requests, which includes PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed (PHP notice). A version shown by a CLI command can come from a different binary.
For the full version list, see the fixed-versions table. For the bug itself, see how the flaw works and who it hits. Other big shared hosts have their own notices, such as Bluehost's status page and GoDaddy's hosting answer, and the other host status guides sit together.
How do I confirm my HostGator site is patched?
What do I do if HostGator manages my PHP?
Send HostGator support this exact question and keep the reply:
For [your domain], is the PHP runtime that serves web requests patched for CVE-2026-109618 and CVE-2026-109619? Please give the fixed package, build or backport identifier, confirm that all PHP-FPM, CGI or Apache workers serving it have been restarted or replaced, and say whether I need to change a setting.
- Open the HostGator status notice and note its last update time.
- Check your inbox and spam folder for a direct email from HostGator about PHP.
- Send the question above and save the reply with its date.
- If you pinned a PHP version in the portal or MultiPHP Manager, say so in the ticket.
- If the reply gives only a branch number, ask again for the build and the restart time.
What do I do if I manage a HostGator VPS or dedicated server?
- Update PHP through your control panel package update. Check the installed package against your package vendor's fixed-version guidance. CloudLinux, for example, says some native PHP 8.2 and 8.3 packages carry no CVE ids in their changelog and must be checked by version, 8.2.35 or 8.3.36 or later (CloudLinux).
- Restart the PHP services that serve your sites, such as Apache and PHP-FPM (why the restart counts).
- Confirm the build the web workers use, not the CLI (PHP notice scopes the risk to installations serving web requests).
- Check each domain separately if the server runs more than one PHP version.
Am I affected? A three-state self-test
Am I affected? Where you stand right now
A passive check from outside can show a version hint. It cannot see a backport, which runtime serves your domain, or whether workers restarted.
- Detected Your site serves PHP and the exposed version is below the fixed release for its branch. A version below the fix is an affected version. Backports and the uncertainty about which runtime serves the site mean it does not establish exposure. Ask HostGator the question above, or patch and restart yourself today.
- Unknown The version is hidden, or could be a backport. This is the common case on cPanel hosts. HostGator's fleet-level notice does not move you out of it. Get the build and restart time for your domain from support.
- Confirmed by owner evidence You hold the fixed package or build identifier from your host or package vendor, and a restart or redeploy time after it. The runtime is patched. Whether anything got in before the patch is a separate question.
No scan, ours included, moves you from "unknown" to "confirmed".
Was anything exploited on HostGator sites?
We found no primary source that says so. AWS reported exploit attempts against its own honeypots from 17 October, four days before disclosure, and said it is unclear whether any would have succeeded on real systems (AWS Security Blog, 21 October 2026). See is PHP2Shell being exploited for the running record.
What is the bug, without the exploit?
Both CVEs are memory-safety problems in the PHP engine, reachable by an unauthenticated web request. PHP's notice says the risk is highest with mod_php, and that updating is the only complete fix (PHP notice). Updating WordPress or plugins does not close it. We do not reproduce exploit code here, and you do not need it to fix your site.
The wider picture is on the October 2026 tracker.
Questions people ask
Has HostGator patched the PHP vulnerabilities?
HostGator's status page says its teams are deploying patched PHP builds and that most platforms are updated, as of its 23 October 2026 update. That is a fleet statement, not a statement about your server. Ask support to confirm your domain.
cPanel MultiPHP Manager only shows 8.3. How do I confirm the exact build?
The selector shows the branch, not the build or whether the fix is in it. Ask HostGator support for the package or build identifier that names CVE-2026-109618 and CVE-2026-109619, and for the time its workers restarted. A version string alone cannot settle it.
I am on a HostGator VPS or dedicated server. Does HostGator patch it for me?
Not on a self-managed server. HostGator's notice tells customers who manage their own VPS or dedicated server to run a package update through their control panel, and its latest entries tell them to watch for emails about services. The notice's 22 October 11:00 EST entry says 'If you are on a patched version of PHP, no action is needed' and that HostGator is applying patches, so that line depends on your server already running a patched version. It also says HostGator is emailing affected customers directly with instructions where action is needed. To confirm your own domain, ask support.
Does updating WordPress fix PHP2Shell on HostGator?
No. The bug is in the PHP engine, not in WordPress or its plugins. The fix is a patched PHP build on the server with the workers restarted.
HostGator's status page does not say PHP2Shell. Is it about this bug?
The page cites CVE-2026-109618 and CVE-2026-109619, which are the two PHP2Shell CVEs. The name PHP2Shell itself is not used on the page.
Sources
- HostGator status: PHP Update (announcement 277)HostGator's own notice. Cites both CVEs, lists patched builds by platform, last updated 23 October 2026.
- PHP security notice, 21 October 2026 (php.net)Names both CVEs, the fixed releases, and says every PHP installation serving web requests is in scope.
- GHSA-w8hw-w9fx-j79w: CVE-2026-109618 (php/php-src advisory)
- GHSA-6wmf-4rv5-p3rp: CVE-2026-109619 (php/php-src advisory)
- HostGator help: PHP configurationCustomer Portal and cPanel paths to the PHP version. The article does not mention PHP2Shell.
- CloudLinux: fixed ea-php and alt-php packages (blog, updated 23 October 2026)Vendor of the cPanel EasyApache and alt-php packages. It does not mention HostGator.
- PHP 8 changelog (php.net)8.5.12 and 8.4.27 entries dated 22 October list both advisories. No 8.5.13 at our check.
- Amazon Threat Intelligence: PHP2Shell attempts in MadPot honeypots (AWS Security Blog, 21 October 2026)Vendor telemetry. AWS says it is unclear whether the early attempts would have succeeded on real systems.
Facts on this page are dated and point at the primary source next to them. If a vendor status changes after the date shown, the vendor's page wins; tell us at support@run.cloud and we will update it.