hosting
GoDaddy: security status
Summary
Official blog (updated Oct 21-23): GoDaddy reports it 'patched all PHP versions' on Managed WordPress at 19:30 UTC on Oct 21, on Windows Hosting at 01:20 on Oct 22 and on Web Hosting (cPanel) at 13:30 on Oct 22. Web Hosting uses CloudLinux packages, so a patched build may keep its old version number; the post says to check for a build date of Oct 21 2026 or later. VPS customers run PHP themselves. On Oct 23 it noted a separate, still unpatched CVE-2026-115560 and told VPS users to set session.upload_progress.enabled to 0. The post's header date (Oct 20) does not match its contents.
Customer action:
No action on Managed WordPress, Windows Hosting or Web Hosting. On Web Hosting, check that phpinfo's build date is Oct 21 2026 or later. PHP 8.1 and older get no upstream fix; GoDaddy recommends 8.2 or later. VPS customers must update PHP to a fixed release, restart PHP and the web server, and set session.upload_progress.enabled to 0.
Source: https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do
Verified: 2026-10-26
GoDaddy's network (AS26496, AS398101, AS398787) also carries its VPS and dedicated servers, where the customer runs PHP, and its domain-forwarding servers (redirect-*.secureserver.net); an address there cannot be told apart from Web Hosting or Managed WordPress by DNS. Domains registered at GoDaddy use its name servers (*.domaincontrol.com, see godaddy-dns) wherever the site is hosted, so the name servers do not mean the site is hosted at GoDaddy.
How this tool recognises the provider
- AS numbers
AS26496AS398101AS398787- Text in the AS name
GO-DADDY