On shared and managed hosting, your provider decides when the PHP behind your site changes. On a VPS, a container or a platform app, you often decide. This topic collects each provider's dated statement on PHP2Shell, CVE-2026-109618 and CVE-2026-109619, and the question that gets you proof for your own domain.
What matters right now
- The fix is a new PHP build. The PHP project lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 in the php-src advisory, disclosed on 21 October 2026.
- A provider notice covers its platform, not your site. Each article records what the provider's own page said at our 24 October 2026 check, and where we found no notice.
- Some platforms need you to act. Heroku's changelog entry tells owners to redeploy, and AWS says in bulletin 2026-143-AWS that it cannot update running Lightsail instances in place.
- Azure published a dated rollout. Microsoft's App Service notice of 21 October covers Linux built-in PHP versions, with separate handling for Windows and custom containers.
- Version numbers can mislead. Ubuntu and Debian ship fixes as backports, so an old-looking number may already include the fix, per Canonical's post.
Where to start
- If you are on shared hosting, start with what to ask your provider.
- If you run WordPress and want to compare managed hosts, read which WordPress hosts patch automatically.
- If you use Kinsta, SiteGround, WP Engine or Cloudways, open that provider's page.
- If you use GoDaddy, Bluehost, HostGator or Hostinger, start there.
- If you use IONOS, Namecheap, DreamHost or OVHcloud, see the matching status page.
- If you run a VPS or cloud server, read AWS Lightsail, DigitalOcean or Linode and Akamai.
- If you deploy apps on a platform, see Azure App Service, Google Cloud, Heroku, Render or Fly.io.
- If your account was suspended for malware, follow the recovery steps.
- If you manage the server yourself, patch the PHP runtime and then check that PHP-FPM restarted.
The free scan on Red by run.cloud reads the stack your site serves and matches versions to public records. It can say a version is affected. Your host or server has to confirm the rest.