php2shell (CVE-2026-109618 / CVE-2026-109619)
Provider security status
Each provider's official notice (official) and press or roundup articles (secondary), summarised. It can be wrong, so always check the source.
- patched28
- in progress3
- unknown3
- customer-managed19
| Provider | php2shell status | Source |
|---|---|---|
| Xserverhosting · official notice · 2026-10-26 | patched | Xserver link |
| Star Rental Serverhosting · official notice · 2026-10-22 | patched | Star Rental Server link |
| Shin Rental Serverhosting · official notice · 2026-10-22 | patched | Shin Rental Server link |
| wpX Speedhosting · official notice · 2026-10-21 | patched | wpX Speed link |
| SAKURA internethosting · official notice · 2026-10-23 | patched | SAKURA internet link |
| GMO Internet Grouphosting · secondary source | unknown | |
| Lolipop (GMO Pepabo)hosting · official notice · 2026-10-22 | patched | Lolipop (GMO Pepabo) link |
| heteml (GMO Pepabo)hosting · official notice · 2026-10-22 | patched | heteml (GMO Pepabo) link |
| ConoHa WING (GMO Internet)hosting · official notice · 2026-10-22 | patched | ConoHa WING (GMO Internet) link |
| Onamae.com Rental Server (GMO Internet)hosting · official notice · 2026-10-22 | patched | Onamae.com Rental Server (GMO Internet) link |
| WADAX (GMO GlobalSign Holdings)hosting · secondary source | unknown | |
| mixhosthosting · official notice · 2026-10-22 | patched | mixhost link |
| CORESERVER (GMO DigiRock)hosting · official notice · 2026-10-22 | patched | CORESERVER (GMO DigiRock) link |
| KAGOYAhosting · official notice · 2026-10-23 | in progress | KAGOYA link |
| CPI (KDDI Web Communications)hosting · official notice · 2026-10-29 | in progress | CPI (KDDI Web Communications) link |
| ColorfulBoxhosting · official notice · 2026-10-22 | patched | ColorfulBox link |
| Rakko Serverhosting · official notice · 2026-10-22 | patched | Rakko Server link |
| ABLENEThosting · official notice · 2026-10-23 | patched | ABLENET link |
| WebARENA (NTTPC)hosting · official notice · 2026-10-22 | in progress | WebARENA (NTTPC) link |
| Biz Mail & Web (NTT Communications)hosting · official notice · 2026-10-22 | patched | Biz Mail & Web (NTT Communications) link |
| Movable Type Cloud (Six Apart)hosting · official notice · 2026-10-22 | patched | Movable Type Cloud (Six Apart) link |
| GoDaddyhosting · official notice · 2026-10-22 | patched | GoDaddy link |
| Hostingerhosting · official notice · 2026-10-22 | patched | Hostinger link |
| IONOShosting · official notice · 2026-10-22 | patched | IONOS link |
| OVHcloudcloud (IaaS) · secondary source | customer-managed | |
| OVHcloud Web Hostinghosting · official notice · 2026-10-26 | patched | OVHcloud Web Hosting link |
| Namecheapcloud (IaaS) · official notice · 2026-10-21 | customer-managed | Namecheap link |
| Namecheap Shared Hostinghosting · official notice · 2026-10-22 | patched | Namecheap Shared Hosting link |
| DreamHosthosting · official notice · 2026-10-23 | patched | DreamHost link |
| WP Enginehosting · official notice · 2026-10-22 | patched | WP Engine link |
| Kinstahosting · official notice · 2026-10-22 | patched | Kinsta link |
| Vercelsite platform · official notice · 2026-10-21 | customer-managed | Vercel link |
| Netlifysite platform · secondary source | customer-managed | |
| Color Me Shop (GMO Pepabo)site platform · official notice · 2026-10-22 | patched | Color Me Shop (GMO Pepabo) link |
| BASEsite platform · secondary source | unknown | |
| makeshopsite platform · official notice · 2026-10-23 | patched | makeshop link |
| Shopifysite platform · secondary source | customer-managed | |
| Wixsite platform · secondary source | customer-managed | |
| Jimdosite platform · secondary source | customer-managed | |
| Railwayapplication platform (PaaS) · secondary source | customer-managed | |
| Zeaburapplication platform (PaaS) · secondary source | customer-managed | |
| IDC Frontiercloud (IaaS) · secondary source | customer-managed | |
| Zenlogic (IDC Frontier)hosting · official notice · 2026-10-23 | patched | Zenlogic (IDC Frontier) link |
| NIFCLOUD / FJcloud-V (Fujitsu)cloud (IaaS) · official notice · 2026-10-23 | customer-managed | NIFCLOUD / FJcloud-V (Fujitsu) link |
| Amazon Web Servicescloud (IaaS) · official notice · 2026-10-22 | customer-managed | Amazon Web Services link |
| Google Cloudcloud (IaaS) · official notice · 2026-10-21 | customer-managed | Google Cloud link |
| Microsoft Azurecloud (IaaS) · secondary source | customer-managed | |
| Alibaba Cloudcloud (IaaS) · secondary source | customer-managed | |
| Vultrcloud (IaaS) · secondary source | customer-managed | |
| Linode / Akamai Cloudcloud (IaaS) · official notice · 2026-10-29 | customer-managed | Linode / Akamai Cloud link |
| DigitalOceancloud (IaaS) · secondary source | customer-managed | |
| Hetznercloud (IaaS) · official notice · 2026-10-22 | customer-managed | Hetzner link |
| SiteGroundhosting · official notice · 2026-10-21 | patched | SiteGround link |
| CloudflareCDN (hides the origin) | — | |
| FastlyCDN (hides the origin) | — | |
| AkamaiCDN (hides the origin) | — | |
| bunny.netCDN (hides the origin) | — | |
| CDN77CDN (hides the origin) | — | |
| Onamae.com DNS (GMO Internet)DNS only | — | |
| Muumuu Domain DNS (GMO Pepabo)DNS only | — | |
| Value-Domain DNSDNS only | — | |
| Gehirn DNSDNS only | — | |
| GoDaddy DNSDNS only | — | |
| IONOS DNSDNS only | — | |
| eMudhra (emSign)certificate issuer (CA) | — | |
| Google Workspace (mail)mail only | — | |
| Microsoft 365 (mail)mail only | — | |
| SAKURA internet (mail)mail only | — | |
| Zoho Mailmail only | — | |
| Proofpoint (mail filter)mail only | — | |
| Mimecast (mail filter)mail only | — |
Last updated: 2026-10-30Report a correction (GitHub)