GoDaddy's PHP2Shell statement is recorded as patched, with statement date printed as Initial metadata 2026-10-20T21:38:56; Web Hosting completion October 22, 2026, 13:30 UTC; latest update October 23, 2026, 21:00 UTC; read the published statement.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Read the statement on www.godaddy.com, dated Initial metadata 2026-10-20T21:38:56; Web Hosting completion October 22, 2026, 13:30 UTC; latest update October 23, 2026, 21:00 UTC. Source type: official page.
Notes
We have patched all PHP versions on Web Hosting. Official notice confirms Managed Hosting for WordPress, Windows Hosting and Web Hosting PHP patch deployment. Web Hosting completion is printed 22 October 2026, 13:30 UTC; the latest article update is 23 October 2026, 21:00 UTC and addresses a separate PHP advisory. Customer-managed VPS software remains the customer's responsibility. Backported Web Hosting package versions may retain their earlier PHP version number. No VPS deployment is inferred.
Change log
: first check
: Source-only recheck completed; published classification unchanged.
: Primary-source scope review: classification changed from patched partly to patched. Current source scope and product qualifications are recorded in notes.
What the five engines said
ChatGPT
differs
Captured . Status named: patched. Cites a godaddy.com page.
Yes—GoDaddy’s PHP hosting was affected, but GoDaddy now reports its managed hosting services are patched. Self-managed VPS/server customers must patch PHP themselves. This is the status as of October 23, 2026, based on GoDaddy’s own updates. | GoDaddy service | Reported patch status | |---|---| | Managed Hosting for WordPress | All PHP versions patched; confirmed October 21, 19:30
Captured . Status named: patched. Cites a godaddy.com page.
Here is a full breakdown of GoDaddy's exposure to PHP2Shell and its patch status, based on available sources: What Is PHP2Shell? PHP2Shell is the name used for two critical flaws in PHP itself, which CERT-EU names CVE-2026-109618 and CVE-2026-109619. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. CVE-2026-109618 stems from
Captured . Status named: patched. Cites a godaddy.com page.
Yes—GoDaddy was affected in principle, because PHP2Shell affects unpatched PHP installations. However, GoDaddy states that it patched all PHP versions on its Web Hosting and Windows Hosting platforms as of its October 22, 2026 update, and says customers on those services need take no action. The upstream fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Exception: GoDaddy VPS and
Captured . No status named. Cites a godaddy.com page.
Yes, GoDaddy is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and its patch status varies depending on the hosting tier: Managed Hosting for WordPress: GoDaddy has patched all PHP versions on this tier. Web Hosting and Windows Hosting: GoDaddy stated it is still waiting for upstream vendor and control panel package releases (such as cPanel backports) to roll
Captured . No status named. Cites a godaddy.com page.
Impact: Yes, GoDaddy's hosting environment was exposed to the industry-wide "PHP2Shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because they affect the core PHP language runtime across all hosting providers, rather than being specific to GoDaddy. Patch Status: Yes, GoDaddy confirmed that they have rolled out updates and patches across their standard Web Hosting services, Managed WordPress, and Windows Hosting environments following
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
Badge
The badge for GoDaddy reads PHP2Shell statement listed, Verified 24 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
The status records what the company published, under our statement status rules. A PHP version mentioned in a statement can be guidance for other organisations; the statement and notes explain its scope.
About this page
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.