PHP2Shell statement record · Host
Status in the company's own words: patched. Statement dated Wednesday October 21, 2026; Updated October 22, 07:20 UTC.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on www.hostinger.com, dated Wednesday October 21, 2026; Updated October 22, 07:20 UTC. Source type: official page.we rolled them out across the platform (completed October 22 at 06:44 UTC)
we rolled them out across the platform (completed October 22 at 06:44 UTC)
and is now installed on all Hostinger hosting servers except VPS
quoted from https://www.hostinger.com/blog/protecting-php2shell/ (title: Hostinger deploys protections against php2shell PHP vulnerabilities; authors Gediminas G. & Saulius L.). Mixed: every plan except VPS patched by Hostinger; VPS customers must update: if you manage PHP on your own server, update it and restart it now.
Firewall rules in deny mode and session.upload_progress disabled as mitigations. EOL: PHP 8.1 and older versions no longer get fixes from the PHP project
(its managed hosting still covers those sites); PHP 8.2 security fixes end 31 Dec 2026.
match
Hostinger says its managed hosting was protected against PHP2Shell and is now patched. VPS is the exception: customers must patch it themselves. As of October 23, 2026: | Hosting type | Affected? | Patch status | |---|---|---| | Managed hosting—Web, Cloud, Agency and cPanel | Hostinger says its environment tests found it was not vulnerable to the circulating exploit;
differs
Yes, Hostinger is affected by PHP2Shell — but it has responded quickly and comprehensively. Here is a full breakdown: What is PHP2Shell? On October 21, the PHP project fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. Both are rated 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS). CVE-2026-109618 ("RCE via OOM corruption"): PHP's
no status named
Yes—Hostinger’s managed hosting was not exploitable by the circulating PHP2Shell exploit according to its own testing, and Hostinger says its firewall rules blocked matching attack requests. It has also completed deployment of PHP’s fix across all managed hosting servers as of October 22, 2026 at 06:44 UTC. Web Hosting, Agency Hosting, and cPanel Hosting: patched; customers do not need
no status named
Hostinger stated that its shared and managed hosting environments were not directly vulnerable to the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) due to platform architecture (such as LiteSpeed handling and isolated account permissions), though it has rolled out patched PHP builds across all managed hosting infrastructure . Sources & Status Details Hostinger Status Page & Updates: According to the Hostinger
contradiction
According to Hostinger's incident updates, their platform was not vulnerable to the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Impact Status: After conducting testing in their hosting environments, Hostinger confirmed their platform was not vulnerable and implemented extra layers of protection to block potential attack vectors. Patch/Rollout Status: Although their specific platform configurations prevented exploitation, Hostinger rolled out and deployed patched
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Hostinger reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Hostinger's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Hostinger and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy