Has my host patched PHP2Shell?
What hosting companies have said publicly, with links to their statements. A host that isn't listed, or has no public statement, may still have patched, so ask them directly.
Last checked early afternoon, 22 October 2026. Statuses are changing by the hour. Each entry is what the host says about itself; we haven't tested their servers.
Irish hosts
| Host | Status | What they've said |
|---|---|---|
| Blacknight | Patched | All PHP across shared hosting, control panel servers, managed servers and VPSs. Older versions were patched by backport, so their version numbers didn't change. Their statement |
| Hosting Ireland | Patched | Every PHP version on its shared hosting servers, including backports for older versions. It also added firewall rules and configuration changes. Their statement |
| Letshost | Patched | Every PHP version on its shared servers, including backports, plus firewall rules and configuration changes. Their statement |
| Register365 | No statement found | Nothing about PHP on its status page or blog yet. Status page |
| Irish Domains | No statement found | We couldn't find a public statement. |
UK and international hosts
| Host | Status | What they've said |
|---|---|---|
| 20i | Patched | All PHP versions on all platforms, including Cloud Servers and backported older versions. Their statement |
| Cloudways | Patched | Rollout complete on all active servers. Support is contacting a small number of customers directly. Their statement |
| Flywheel | Patched | Patches deployed across the platform. No action needed from customers. Their statement |
| Hostinger | Patched | Installed on all hosting servers. VPS customers must update PHP themselves. Their statement |
| IONOS | Patched | Official PHP updates applied on the platforms it runs, and the incident is marked resolved. VPS and dedicated server owners must update PHP themselves. Their statement |
| Kinsta | Patched | PHP 7.4 to 8.5 updated across the platform. Its extra protections stay in place. Their statement |
| Pantheon | Patched (live sites) | All live sites and paid non-live environments patched. Free and sandbox environments to follow within 24 to 48 hours. Their statement |
| WP Engine | Patched | Deployment finished, including PHP 8.2.35, 8.4.27, 8.5.12 and a patched 7.4 build. Their statement |
| 34SP.com | In progress | WordPress hosting on PHP 8.2 and newer is patched. Older PHP, legacy platforms and reseller servers are still being done. Their statement |
| Bluehost | In progress | Most servers patched, the rest being finished, with extra protections in place meanwhile. Customers may see limits on upload sizes. Their statement |
| Fasthosts | In progress | Now monitoring. It says its systems are stable, but hasn't confirmed the update is fully installed. VPS and bare-metal owners must update PHP themselves. Their statement |
| GoDaddy | In progress | Managed WordPress and Windows hosting patched. Web Hosting still being deployed. VPS owners must update PHP themselves. Their statement |
| Krystal | In progress | Shared, premium and reseller servers patched. Managed WordPress (Onyx) still in progress. Their statement |
| Namecheap | In progress | Fixed on all servers except a short list it names. VPS and dedicated server owners must update PHP themselves. Their statement |
| Rocket.net | Marked resolved | Incident closed after rolling out patches for PHP 5.2 to 8.5 in waves, without saying every server is done. A phpinfo build date of 21 October or later means your site has the fix. Their statement |
| SiteGround | Mitigation only | Server-wide settings that turn off the affected PHP features. Its only post was written before PHP released the fix and hasn't been updated, so it doesn't say patched PHP is installed. Their statement |
Reading these statements
- Your version number may not change. Blacknight, Hosting Ireland, Letshost and others patched older PHP versions by backporting the fix. A patched site can still show a version like 8.1.34. Trust the host's statement, or check the phpinfo Build Date: 21 October 2026 or later is a good sign.
- VPS and dedicated servers are usually excluded. If you rent a server and manage it yourself, the host won't patch PHP for you. See the server guide.
- Firewall rules aren't a patch. “Mitigation only” means the host has blocked known attacks but hasn't yet confirmed that PHP itself is updated.
- Missing your host? Ask them directly. If they've published a statement, tell WP Care and we'll add it.