PHP2Shell statement record · Host
Status in the company's own words: patched partly. Statement dated 2026-10-20T21:38:56 (page metadata); timeline updates to October 22, 2026, 01:20 UTC.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on www.godaddy.com, dated 2026-10-20T21:38:56 (page metadata); timeline updates to October 22, 2026, 01:20 UTC. Source type: official page.We have patched all PHP versions on Managed Hosting for WordPress.
We have patched all PHP versions on Managed Hosting for WordPress.
We have patched all PHP versions on Windows Hosting.
We have the patches from our vendor and are deploying them to all Web Hosting servers now.
quoted from https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do (title: Important PHP security update: What website owners need to do). Web Hosting still deploying at the 22 Oct 01:20 UTC update, with mitigations in place; VPS customers must update PHP themselves or use GoDaddy Expert Services; self-managed: restart PHP and your web server so the update takes effect.
EOL: PHP no longer supports these versions and will not release an official fix for them.
(8.1 and older; upgrade to 8.2+ recommended).
differs
Yes—GoDaddy’s PHP hosting was affected, but GoDaddy now reports its managed hosting services are patched. Self-managed VPS/server customers must patch PHP themselves. This is the status as of October 23, 2026, based on GoDaddy’s own updates. | GoDaddy service | Reported patch status | |---|---| | Managed Hosting for WordPress | All PHP versions patched; confirmed October 21, 19:30
differs
Here is a full breakdown of GoDaddy's exposure to PHP2Shell and its patch status, based on available sources: What Is PHP2Shell? PHP2Shell is the name used for two critical flaws in PHP itself, which CERT-EU names CVE-2026-109618 and CVE-2026-109619. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. CVE-2026-109618 stems from
differs
Yes—GoDaddy was affected in principle, because PHP2Shell affects unpatched PHP installations. However, GoDaddy states that it patched all PHP versions on its Web Hosting and Windows Hosting platforms as of its October 22, 2026 update, and says customers on those services need take no action. The upstream fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Exception: GoDaddy VPS and
no status named
Yes, GoDaddy is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and its patch status varies depending on the hosting tier: Managed Hosting for WordPress: GoDaddy has patched all PHP versions on this tier. Web Hosting and Windows Hosting: GoDaddy stated it is still waiting for upstream vendor and control panel package releases (such as cPanel backports) to roll
no status named
Impact: Yes, GoDaddy's hosting environment was exposed to the industry-wide "PHP2Shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because they affect the core PHP language runtime across all hosting providers, rather than being specific to GoDaddy. Patch Status: Yes, GoDaddy confirmed that they have rolled out updates and patches across their standard Web Hosting services, Managed WordPress, and Windows Hosting environments following
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for GoDaddy reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
GoDaddy's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about GoDaddy and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy