Managed web hosting
The provider typically installs PHP security fixes. You confirm its latest advisory, your plan's coverage, and any custom runtimes.
PHP2SHELL / HOSTING PROVIDER TRACKER
Has your host patched PHP?
Find out what 20 major hosting and cloud providers say about their PHP security response, who's responsible for fixing each service, and what you should do next.
Reviewed October 23, 2026 · 20 providers · 46 service types · Source-linked, manually curated snapshot
Read this first: These are provider-reported statements about CVE-2026-109618 and CVE-2026-109619, not independently tested hosts. "Provider reports patched" is not a guarantee that your specific runtime is patched. This information can change quickly. A separate October 23 PHP advisory also requires attention.
THE IMPORTANT DISTINCTION
Same host.
Different responsibility.
Shared hosting usually leaves PHP patching to the provider. A self-managed VPS usually leaves it to you. Cloud and application platforms can split responsibility between base-image updates and customer redeployment.
VPS and dedicated
You generally patch the operating system or PHP runtime yourself, restart workers, and test the actual web-serving application.
Cloud and PaaS
The vendor may patch a base image while your team must rebuild, redeploy, or explicitly enable a platform update.
THE PROVIDER-BY-PROVIDER RESPONSE
Find your hosting
service.
Select your service type, search your provider, or filter by responsibility and patch status. Expand a provider for official guidance, recommended action, and where Edgar Tech can help.
20providers reviewed
46service offerings
19provider-reported patched offerings
19customer-action offerings
Amazon Web Services (AWS) AWS services themselves are not affected, but PHP deployed by customers can be; responsibility differs by runtime.
Provider advisory: Read official statement ↗ Additional vendor guidance ↗
Important: Use the AWS bulletin and Amazon Linux security notices; WAF rules offer only temporary defense in depth.
Elastic Beanstalk + managed platform updates
Rollout / verify
Depends on the plan
What you should do
AWS has published patched PHP platform versions. With Managed Platform Updates enabled, an update is applied during the configured maintenance window; verify the environment platform release after that window.
Where Edgar Tech can help
Patch status audit and safe upgrade scheduling.
Elastic Beanstalk + manual updates
Customer must act
Customer manages PHP
What you should do
If managed updates are not enabled, deploy the updated Elastic Beanstalk platform yourself and verify the live environment.
Where Edgar Tech can help
Version upgrade, rollback and validation.
EC2 / Lightsail / custom PHP on Amazon Linux
Customer must act
Customer manages PHP
What you should do
AWS does not manage PHP installed inside your VM. Apply the appropriate OS vendor package fixes and restart services; Amazon Linux patches are available for supported repos.
Where Edgar Tech can help
Automated patching and evidence collection.
Lambda custom runtimes / containers
Customer must act
Customer manages PHP
What you should do
AWS does not provide a managed PHP Lambda runtime; rebuild your custom runtime/container with patched PHP and redeploy.
Where Edgar Tech can help
Image/runtime modernization and deployment tests.
Bluehost Bluehost says most hosting infrastructure is updated but the remaining patch rollout is still underway.
Provider advisory: Read official statement ↗
Important: Status is not an assertion that any individual Bluehost site is still vulnerable. Vendor lists patched package versions.
Shared / managed hosting
Rollout / verify
Provider manages PHP
What you should do
Bluehost reports staged deployment and interim mitigations. Ask support for the exact server/product's patch completion and validate vendor build evidence.
Where Edgar Tech can help
Verification or coordination if a specific environment remains outstanding.
Customer-managed VPS / dedicated
Customer must act
Customer manages PHP
What you should do
Bluehost directs VPS/dedicated administrators to monitor notices and apply the current cPanel, Plesk, CloudLinux or OS security packages themselves.
Where Edgar Tech can help
Vendor-specific patch and validation.
Cloudways Cloudways reports completing its managed PHP security patch rollout and keeps separate protections for the October 23 issue.
Provider advisory: Read official statement ↗
Important: Cloudways reports separate mitigations for CVE-2026-115560 (October 23); do not conflate that issue with the October 21 fixes.
Cloudways managed servers / applications
Provider reports patched
Provider manages PHP
What you should do
Cloudways says all active servers were updated by October 22 and the PHP2Shell incident closed October 23; contact support if they notified you of an exception.
Where Edgar Tech can help
Independent runtime verification; custom application smoke tests.
DigitalOcean DigitalOcean has patched its PHP buildpacks, but most deployed applications still require customer redeployment or package updates.
Provider advisory: Read official statement ↗
Important: DigitalOcean distinguishes its own infrastructure from PHP installed inside customer compute; Cloudways is a separately managed product (listed above).
App Platform buildpack / Functions
Customer must act
Customer manages PHP
What you should do
DigitalOcean says patched runtimes/buildpacks are available; redeploy the application/function to activate them. Custom Dockerfiles must use patched base images.
Where Edgar Tech can help
Safe build/redeploy, runtime verification and tests.
Droplets / existing Marketplace 1-Click images
Customer must act
Customer manages PHP
What you should do
Previously deployed Droplets and Marketplace app images do not automatically receive PHP updates. Update packages/images and restart affected processes.
Where Edgar Tech can help
Fleet inventory, package patching, testing.
Kubernetes / custom containers
Customer must act
Customer manages PHP
What you should do
Rebuild container images using a trusted patched runtime and redeploy workloads.
Where Edgar Tech can help
CI/CD image update and rollout.
DreamHost DreamHost says its PHP security updates were applied across its network, including shared, DreamPress and VPS offerings.
Provider advisory: Read official statement ↗
Important: Provider's status statements remain the source of truth for the individual service.
Shared Hosting / DreamPress
Provider reports patched
Provider manages PHP
What you should do
DreamHost reports applying the official PHP updates across its hosting platforms. Confirm any older Extended Support runtime's specific backport.
Where Edgar Tech can help
Verification and supported-version planning.
Self-managed VPS / customized PHP
Confirm exact coverage
Depends on the plan
What you should do
DreamHost reports network-wide security work, but independently installed/custom PHP may not be covered. Confirm your product's responsibilities with DreamHost and inspect the serving runtime.
Where Edgar Tech can help
Responsibility assessment and patching if customer-managed.
GoDaddy GoDaddy says its managed hosting platforms have been patched; VPS operators must act.
Provider advisory: Read official statement ↗
Important: Vendor backports can keep the displayed PHP version number unchanged; ask for the exact fixed build.
Web Hosting / cPanel
Provider reports patched
Provider manages PHP
What you should do
GoDaddy reports web hosting PHP patched; confirm the PHP build or build date on your specific site. No customer-side PHP upgrade required for these CVEs.
Where Edgar Tech can help
Independent verification; legacy-runtime review.
Managed WordPress / Windows Hosting
Provider reports patched
Provider manages PHP
What you should do
GoDaddy reports managed WordPress and Windows Hosting patched. Monitor further advisories; verify if you have unusual/custom PHP integrations.
Where Edgar Tech can help
Independent assurance and application smoke testing.
Self-managed VPS
Customer must act
Customer manages PHP
What you should do
Update PHP via the OS or WHM/EasyApache 4, restart web workers and test the application; do not assume GoDaddy's shared-hosting rollout covers your VPS.
Where Edgar Tech can help
Authorized patch, rollback and validation.
Google Cloud Google says its cloud platform is not affected, but customer PHP workloads need patching based on the deployment model.
Provider advisory: Read official statement ↗
Important: Cloud Armor managed rules are mitigating controls only; they do not replace PHP runtime updates.
App Engine Standard — supported PHP
Provider reports patched
Provider manages PHP
What you should do
Google says supported App Engine Standard runtimes receive automatic patched base images. Verify your application uses a supported runtime; upgrade old PHP.
Where Edgar Tech can help
Runtime inventory and modernization planning.
Cloud Run / Functions with automatic base-image updates
Rollout / verify
Depends on the plan
What you should do
Google is rolling out patched base images where automatic updates are enabled. Verify your service's image and policy rather than assuming completion.
Where Edgar Tech can help
Verify deployment/automatic-update settings.
App Engine Flexible / Cloud Run custom images
Customer must act
Customer manages PHP
What you should do
Google says flexible apps must redeploy, and custom images require rebuilding with patched PHP; disabled auto-update also requires redeploy.
Where Edgar Tech can help
Patch image, build and deploy safely.
Compute Engine / GKE customer PHP
Customer must act
Customer manages PHP
What you should do
Customer owns PHP installed in VMs and containers. Update OS/packages or image, restart or redeploy, and verify.
Where Edgar Tech can help
Cloud VM and Kubernetes remediation.
Hetzner Hetzner says Webhosting and Managed Servers are patched; Cloud and Dedicated Root server owners must handle their own PHP.
Provider advisory: Read official statement ↗
Important: Provider-specific scope is Webhosting and Managed Servers, not every Hetzner customer VM.
Webhosting / Managed Server
Provider reports patched
Provider manages PHP
What you should do
Hetzner reports 7.4 and 8.0–8.5 patched October 21, then 5.6 and 7.3 patched October 22, on managed infrastructure.
Where Edgar Tech can help
Confirm runtime and plan migration off older branches.
Cloud Server / Dedicated Root
Customer must act
Customer manages PHP
What you should do
Hetzner notified cloud/dedicated clients but does not administer PHP inside self-managed servers. Apply approved vendor updates and verify.
Where Edgar Tech can help
Patch management and remediation evidence.
HostGator HostGator says its patch rollout continues; most platforms have been updated.
Provider advisory: Read official statement ↗
Important: Current advisory includes cPanel/Plesk and CloudLinux build details, not a blanket patched claim.
Shared / managed hosting
Rollout / verify
Provider manages PHP
What you should do
HostGator says remaining hosts are being updated with interim mitigations. Confirm the status of your individual server with support.
Where Edgar Tech can help
Independent patch-state verification and unresolved-risk analysis.
Customer-managed VPS / dedicated
Customer must act
Customer manages PHP
What you should do
Review HostGator's patch tables, update the actual runtime using your panel or OS vendor, restart services and validate.
Where Edgar Tech can help
Authorized remediation and evidence report.
hosting.com (formerly A2 Hosting) hosting.com reports its PHP-related maintenance completed October 22; self-managed servers remain customer-operated.
Provider advisory: Read official statement ↗
Important: Backported PHP builds can retain the older upstream version; inspect build date or package changelog.
Shared cPanel / Plesk / managed panels
Provider reports patched
Provider manages PHP
What you should do
hosting.com reports rollout completed across its hosting products and says customers need not act on its managed cPanel/Plesk offerings.
Where Edgar Tech can help
Independent assurance and application compatibility testing.
Enhance / Control panel
Provider reports patched
Provider manages PHP
What you should do
hosting.com says patches are installed for offered PHP 7.4+ builds. Check the panel and runtime used by each site.
Where Edgar Tech can help
Patch build and service verification.
Self-managed VPS / root server
Customer must act
Customer manages PHP
What you should do
Apply your OS, cPanel/Plesk or CloudLinux package updates and restart PHP; don't assume the provider did it inside your server.
Where Edgar Tech can help
Authorized patching and verified closure.
Hostinger Hostinger reports completed managed-hosting updates; it explicitly excludes customer-managed VPS runtimes.
Provider advisory: Read official statement ↗
Important: Hostinger also posted guidance about a separate PHP CVE disclosed October 23; check its newest update.
Web / Agency / cPanel Hosting
Provider reports patched
Provider manages PHP
What you should do
Hostinger says all managed hosting servers were updated. hPanel PHP Info shows the Build Date, which can be newer even when the PHP version stays the same.
Where Edgar Tech can help
Independent verification or unsupported-PHP modernization.
VPS hosting
Customer must act
Customer manages PHP
What you should do
Hostinger says VPS customers manage PHP. Apply supported OS/vendor fixes and verify every exposed web-serving runtime.
Where Edgar Tech can help
Patch execution and verification.
InMotion Hosting InMotion reports shared, reseller, WordPress, dedicated and UltraStack patched; managed VPS/CWP rollout remains product-specific.
Provider advisory: Read official statement ↗
Important: InMotion also applied configuration mitigations; these do not substitute for completed PHP patch installation. The October 22 advisory distinguishes managed from self-managed servers.
Shared / Reseller / WordPress hosting
Provider reports patched
Provider manages PHP
What you should do
InMotion says patched CloudLinux PHP builds are installed on all Shared, Reseller and WordPress hosting nodes. No customer-side PHP patch is required for these plans; verify legacy compatibility separately.
Where Edgar Tech can help
Independent patch/build verification and moving older sites to supported PHP.
Managed dedicated / UltraStack ONE
Provider reports patched
Provider manages PHP
What you should do
InMotion says dedicated and UltraStack ONE servers were patched. Confirm your server uses the host-managed PHP packages rather than a custom installed runtime.
Where Edgar Tech can help
Runtime evidence, application smoke tests, and exception analysis.
Managed VPS / Control Web Panel (CWP)
Rollout / verify
Provider manages PHP
What you should do
InMotion reported most VPS patched and ongoing CWP 1.21 rollout and PHP rebuilds as of October 22. Verify the exact server and panel with InMotion support/status updates.
Where Edgar Tech can help
Confirm completion, identify runtime/panel exceptions and test applications.
Self-managed VPS / dedicated
Customer must act
Customer manages PHP
What you should do
InMotion explicitly directs self-managed root administrators to update PHP via EasyApache 4 or OS packages and restart Apache/PHP-FPM. Backed-up, authorized changes are required.
Where Edgar Tech can help
Scoped patch rollout, service restarts, validation and audit evidence.
IONOS IONOS says official security fixes are deployed on platforms it operates; self-hosted runtimes remain the customer's responsibility.
Provider advisory: Read official statement ↗
Important: IONOS warned of phishing emails impersonating PHP security notifications; verify notices through its own portal.
Web Hosting / Managed WordPress / MyWebsite
Provider reports patched
Provider manages PHP
What you should do
IONOS states its provider-operated PHP services are patched. Verify if the site uses custom hosting outside those products.
Where Edgar Tech can help
Verification and legacy-PHP migration.
VPS / dedicated / root-managed PHP
Customer must act
Customer manages PHP
What you should do
Install the appropriate PHP and OS security updates yourself, restart web-serving processes, and test the hosted apps.
Where Edgar Tech can help
Authorized inventory, patching and report.
Kinsta Kinsta says PHP patches were rolled out across its managed WordPress platform.
Provider advisory: Read official statement ↗
Important: Kinsta posted a separate October 23 notice concerning CVE-2026-115560 and its mitigations.
Managed WordPress hosting
Provider reports patched
Provider manages PHP
What you should do
Kinsta reports all sites protected and patched on October 22. It also maintains edge and local protections; no customer-side runtime patch was required.
Where Edgar Tech can help
Optional independent assessment, application test or future upgrade plan.
Liquid Web Liquid Web reports a staged patch rollout across hosting environments; it has not stated that all are finished.
Provider advisory: Read official statement ↗
Important: The October 23 vendor statement provides package builds and suggests checking phpinfo; some published legacy rows contain apparent copy errors, so validate against the original vendor changelog.
Managed cPanel / Plesk hosting
Rollout / verify
Provider manages PHP
What you should do
Liquid Web lists available patched builds and is still deploying and verifying environments. Ask support whether your specific environment is complete.
Where Edgar Tech can help
Read-only verification, exception follow-up and application testing.
Self-managed VPS / dedicated
Customer must act
Customer manages PHP
What you should do
If you manage the OS/PHP packages, install the appropriate vendor builds through the panel or package manager, restart PHP and verify.
Where Edgar Tech can help
Scope, patch execution and validation.
Namecheap Namecheap states patching is complete on its shared-hosting fleet; VPS and dedicated customers must update themselves.
Provider advisory: Read official statement ↗
Important: CloudLinux may backport patches without a PHP version-string change; follow Namecheap's October 23 build guidance.
Shared / reseller hosting
Provider reports patched
Provider manages PHP
What you should do
Namecheap reports all PHP versions offered on shared hosting are patched, including older backported builds. No self-patching is needed on the shared platform.
Where Edgar Tech can help
Optional confirmation, compatibility or migration advice.
VPS / dedicated server
Customer must act
Customer manages PHP
What you should do
Namecheap explicitly instructs customers administering VPS/dedicated servers to apply PHP security updates themselves.
Where Edgar Tech can help
Authorized security update and verification.
OVHcloud OVHcloud says it deployed PHP fixes to all Web Hosting clusters, including older versions; Bare Metal and VPS remain customer-managed.
Provider advisory: Read official statement ↗ Additional vendor guidance ↗
Important: OVHcloud's status page still notes extended maintenance even after the older-branch patches; check the live incident before assuming the window is over.
Web Cloud / shared Web Hosting
Provider reports patched
Provider manages PHP
What you should do
OVHcloud reports patched PHP 7.4–8.5 across clusters on October 21 and older 5.3–7.3 on October 23. Confirm your individual environment, especially during maintenance.
Where Edgar Tech can help
Independent verification or compatibility troubleshooting.
VPS / Bare Metal / dedicated
Customer must act
Customer manages PHP
What you should do
OVHcloud explicitly instructs root/VPS users to update PHP themselves. Patch OS or base image, restart web workers and test.
Where Edgar Tech can help
Automated host remediation and report.
Pantheon Pantheon says its PHP image rollout finished across customer environments, including supported and LTS builds.
Provider advisory: Read official statement ↗
Important: Pantheon also reported mitigations for a distinct October 23 PHP advisory.
Paid live / customer environments
Provider reports patched
Provider manages PHP
What you should do
Pantheon says updates to all customer PHP images completed by October 21 evening, with monitoring and network protections continuing.
Where Edgar Tech can help
Independent runtime/app verification if required.
Free / sandbox environments
Confirm exact coverage
Provider manages PHP
What you should do
Earlier status updates scheduled sandbox fixes over 24–48 hours; the later closure does not separately enumerate every free sandbox. Check your environment or ask Pantheon.
Where Edgar Tech can help
Check patch state for a specific sandbox.
SiteGround SiteGround states the official fixes were applied across its hosting servers and customers do not need to update PHP for these CVEs.
Provider advisory: Read official statement ↗
Important: SiteGround also reports protective configuration measures for older available PHP versions; confirm any unusual version or override.
Shared / WordPress / managed PHP
Provider reports patched
Provider manages PHP
What you should do
SiteGround says it controls PHP at the server layer and patched the supported versions. No customer patch action is requested.
Where Edgar Tech can help
Optional verification or legacy-version planning.
SiteGround Cloud Hosting
Provider reports patched
Provider manages PHP
What you should do
SiteGround's platform-wide statement includes managed hosting; verify the exact contract if you administer a separate custom PHP stack.
Where Edgar Tech can help
Custom-stack review if outside provider-managed scope.
WP Engine WP Engine says every customer site is running a patched PHP build and no customer action is required.
Provider advisory: Read official statement ↗
Important: Source is an official October 22 company notice, not independent scanning of customer sites.
Managed WordPress / WP Engine hosting
Provider reports patched
Provider manages PHP
What you should do
WP Engine says all its customer sites were patched after proactive mitigation. No customer action for these two PHP runtime CVEs.
Where Edgar Tech can help
Optional confidence check or non-PHP application work.
No matching hosting services. Clear filters or check the provider's official support channel.
These 20 providers are a research selection, not a verified market-share ranking. Status refers to a specific service category and to the provider's dated statement, not to any particular customer server. Independently installed PHP, custom images, old branches, and third-party packages may fall outside a host's managed coverage. Review the official notice before acting.
YOUR NEXT STEP
What actually needs
to be verified?
Version strings can be misleading: hosting vendors sometimes backport security fixes without changing PHP's headline version. Check the runtime actually serving requests, the vendor package/build or image digest, restart/redeployment state, and an application smoke test.
Never assume a firewall rule or mitigation alone is a complete PHP fix.
A simple verification checklist
- Confirm who controls PHP for the exact plan.
- Locate every web-serving PHP runtime, not just the CLI.
- Check upstream or vendor-backported patch evidence.
- Verify service reload/redeployment and basic function.
- Document what is fixed, outstanding, or needs migration.
EDGAR TECH / PHP SECURITY
Provider says patched. Is your environment?
We help smaller development teams, MSPs and business owners verify actual PHP runtime patch state, implement approved fixes, and document the result. Start with a scoped conversation—not an unsolicited scan.