PHP2Shell statement record · Host
Status in the company's own words: patched. Statement dated Written on October 21, 2026; Updated on October 22, 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on hosting.com, dated Written on October 21, 2026; Updated on October 22, 2026. Source type: official page.
A2 Hosting now operates as Hosting.com (a2hosting.com and status.a2hosting.com redirect to hosting.com and status.hosting.com). we have already handled the updates and there is nothing further you need to do.
(managed plans) and these backported security fixes are already applied to earlier versions of PHP running on our systems.
quoted from https://hosting.com/blog/protecting-against-php2shell-vulnerabilities/ (author Konstantin Kolarov; title: The php2shell PHP flaw: what it means for your website). Mixed: unmanaged VPS and dedicated customers must update themselves and restart all PHP workers and services.
; PHP 8.1 and earlier no longer get regular fixes from the PHP project.
(managed sites on 8.1 and earlier covered via CloudLinux Hardened PHP). Status incident https://status.hosting.com/incident/3174 (PHP Update): The PHP-related service update has been completed successfully.
(Resolved Oct 22, 2026 17:02 CST, as read in a browser at 00:40Z); an earlier cached fetch showed the incident still Recovering at Oct 22, 2026 03:09 CST.
no status named
A2 Hosting has addressed PHP2Shell and reports its managed-platform update complete; self-managed servers require customer action. A2 Hosting now operates as hosting.com, so its official status page is the relevant source. As checked on October 23, 2026: Affected? The provider’s security-update notice explicitly references CVE-2026-109618 and CVE-2026-109619 and describes deploying patches across its platforms. This confirms remediation was applicable,
contradiction
Based on my research, I was unable to find any public statement, advisory, or announcement from A2 Hosting specifically addressing PHP2Shell (CVE-2026-109618 and CVE-2026-109619). There is no press release, knowledge base article, or blog post from A2 Hosting in the available search results regarding this vulnerability. I cannot confirm whether A2 Hosting has patched or officially responded to PHP2Shell
no status named
A2 Hosting is potentially affected, because PHP2Shell affects unpatched PHP installations serving web requests, regardless of hosting provider. However, there is no publicly verifiable A2 Hosting statement in the available sources confirming whether its servers were affected or whether patching has been completed. The PHP fixes were released on October 21, 2026, in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
no status named
Yes, A2 Hosting uses standard cPanel/EasyApache and shared infrastructure affected by the core PHP vulnerabilities known as PHP2Shell ( CVE-2026-109618 and CVE-2026-109619), and platform vendors and upstream package maintainers (such as cPanel and CloudLinux) have been rolling out backported patches across shared hosting and managed environments. hosting.com +2 Overview of Impact and Patch Status Vulnerability Nature : CVE-2026-109618 (out-of-memory
no status named
Affected Status: Yes, potentially. Any hosting environment running unpatched versions of PHP handling web requests (such as Apache, LiteSpeed, or PHP-FPM) is inherently exposed to the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) until the underlying PHP runtime is upgraded. Because web hosting providers like A2 Hosting host applications running various PHP versions across user accounts, servers are
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for A2 Hosting reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
A2 Hosting's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about A2 Hosting and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy