hosting
Hostinger: security status
Summary
Official (blog of Oct 21, updated Oct 22-23, plus status page): by 06:44 UTC on Oct 22 the PHP fix was installed on all hosting servers except VPS (Web, Cloud, Agency and cPanel), with patched builds for every version from 5.2 to 8.5 on Web, Cloud and cPanel. The fix was built into the existing versions, so the number may stay at e.g. 8.5.11; a PHP Info build date of Oct 21 2026 or later in hPanel means it is applied. Hostinger says the Oct 21 changes also cover CVE-2026-115560 (disclosed Oct 23) on all plans except VPS. VPS customers run PHP themselves.
Customer action:
Nothing to do on any plan except VPS. VPS customers should update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart it (if they cannot yet, set session.upload_progress.enabled = Off in php.ini or the PHP-FPM pool and restart all workers). PHP 8.2 stops getting security fixes on Dec 31 2026, so plan a move to 8.3 or newer.
Source: https://www.hostinger.com/blog/protecting-php2shell/
Verified: 2026-10-26
Hostinger's name servers (*.dns-parking.com) also serve its VPS, where the customer runs PHP, and domains registered at Hostinger, so the name servers alone do not prove the site is on Hostinger's managed hosting. Part of its address space (213.210.57.0/24) is also covered by AS8851 (GCI) prefixes, so the ASN can read as GCI there; the cdn.hstgr.net CNAME then identifies Hostinger, and a host with only an A record there shows an unmatched GCI network.
How this tool recognises the provider
- AS numbers
AS47583- Text in the AS name
HOSTINGER- Name servers
*.dns-parking.com- CNAME
*.cdn.hstgr.net