php logo

Concerned about the PHP2Shell vulnerability?

Hello Geeks! 👋

We wanted to address the PHP vulnerability (aka “PHP2Shell”) that made headlines yesterday.

The short version: if you’re hosted on WP Engine, Hostgator, or Bluehost – you’re in good shape.

Here’s where things stand:

✅ WP Engine – patches fully deployed across all customer platforms as of this morning.

✅ Hostgator – majority of servers patched; remaining updates in progress with temporary mitigations active.

✅ Bluehost – majority of servers patched; final updates rolling out now.

All three have applied the necessary server-level fixes for the remote code execution flaws (CVE-2026-109618 & CVE-2026-109619), so your sites are protected.

As of today (Oct 22, 13:30 UTC), GoDaddy has patched all PHP versions across their managed services:

  • Managed Hosting for WordPress – fully patched (confirmed since Oct 21)

  • Web Hosting & Windows Hosting – now patched (confirmed Oct 22 at 13:30 UTC). Their statement: “We have patched all PHP versions on Web Hosting. You don’t need to take any action.”

  • VPS – self-managed; customers are responsible for applying the PHP update themselves (cPanel backported the fix to PHP 7.4, 8.0, and 8.1 packages via EasyApache 4)

To resolve this issue on your own, be sure to update your PHP versions to at least PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

Questions? Drop us a message or give us a call. We’re here to help.