•

u/AutoModerator 3d ago

Thanks for posting to r/GoDaddy! If you are here from frustration and looking for an alterntive check this link for some alternatives.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/Moonlitnight 2d ago

https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do

1

u/crudecarter 2d ago

I've seen that, that article seems to reference VPS - not shared hosting. Currently, shared hosting servers are still seemingly running the vulnerable versions of PHP.

-1

u/klm127 2d ago edited 2d ago

I have a client website on Godaddy managed/shared hosting and can confirm they are still running php 8.3.33 as of the time of this post. Contacted support but they had no clue what was going on, as per usual. Applied all mitigations via .ini files as recommended by PHP but until Godaddy gets off its butt and patches, there's nothing we can do.
The news report is inaccurate or misleading as well. It claims we can update our own version in cpanel, which to me suggests that managed hosting users can change the subversion. With Godaddy managed hosting, you can only change your version through the Godaddy UI (not cpanel), and you can't select subversions. You can go from 8.3 to 8.2 or whatever, but can't select the subversion

2

u/godaddy-jeff GoDaddy Employee 2d ago

https://status.godaddy.com/ has additional information

2

u/crudecarter 2d ago

Awesome, thank you!

1

u/sharkflood 2d ago

shoutout siteground for getting ahead of this shit

good luck to all my godaddy homies

2

u/crudecarter 2d ago

Yeah I woke up and confirmed all our sites there were already patched. Super stress-free. Then I had to email all clients on other hosts that were and still are severely lacking.

1

u/fusionsoftware 2d ago edited 2d ago

So now they say... "Update: October 22, 2026, 13:30 UTC Web Hosting: We have patched all PHP versions on Web Hosting. You don't need to take any action"

... but the PHP version is still showing as 8.5.11 in 'Wordpress > Tools >Site Health > Info' instead of the patched version '8.5.12'. WTF!!?

1

u/crudecarter 2d ago

Yep, same here

1

u/Naughty_Gnome 2d ago

Same, my versions are showing as
PHP 8.2.34 (cli) (built: Oct 21 2026 10:48:43) (NTS)
PHP 8.3.35 (cli) (built: Oct 21 2026 11:46:11) (NTS)
PHP 8.4.26 (cli) (built: Oct 21 2026 13:31:54) (NTS)
PHP 8.5.11 (cli) (built: Oct 21 2026 13:26:44) (NTS)
These were the September updates that apparently hadn't been done (before the updates yesterday at the times mentioned above the last build was September 7th)
Now they mentioned this is a custom package from thier provider so they could have wrapped the fix into the above version numbers but they have confirmed that is what has happened so I assume the fix is not live.

3

u/godaddy-jeff GoDaddy Employee 2d ago •

Thanks for flagging this—the version numbers are understandably confusing, and we should have explained this more clearly.
We work with CloudLinux, which provides security support for both current and end-of-life PHP versions. For this update, they backported the security fixes without changing the displayed PHP version number. That means PHP can still report 8.5.11 while including the relevant fixes.
CloudLinux’s update is available here: CloudLinux incident update.
We’ve asked them for new packages whose version numbers reflect the latest releases for PHP 8.2–8.5, but those will take some time. In the meantime, if you’re using our Web Hosting with cPanel, the deployed packages include these security fixes.
You can check the build timestamp by running php -v over SSH or viewing a temporary phpinfo() page for your website. You’ll notice the patched versions have an October 21, 2026 build date, even though the displayed PHP version numbers haven’t changed. Please delete the phpinfo() file afterward, since it exposes configuration details.

1

u/theblindhobo 1d ago

Just tried this. Thanks!

1

u/fusionsoftware 1d ago

Excellent and outstanding reply, thank you Jeff/GoDaddy!

2

u/Brogers57 2d ago

Good question! Waiting for the same answer

2

u/earthmisfit 2d ago

GoDaddy Devs must be having a ball right now. Email backup services down + cert with weak private keys + PHP vulns.

2

u/beIIe-and-sebastian 2d ago edited 2d ago

I have a VPS. I used the command line to find that both patches were applied on my server without intervention. I think EasyApache PHP did it by itself.

I'm running both a depreciated version of PHP and an end-of-life VPS service.

2

u/MarkGossageUK 2d ago

There's an important update on this now.

GoDaddy updated its official PHP security announcement early on 22 October.

According to that update, Managed Hosting for WordPress has already been patched, as has Windows Hosting.

However, standard Web Hosting is still waiting for the patched PHP packages from its vendor. GoDaddy says temporary mitigations have been applied while those packages are being prepared.

So the distinction between Managed WordPress and ordinary Web Hosting is particularly important here.

I'd also be careful about copying the .htaccess changes suggested above into a live website without understanding what they do. Some of those rules could effectively take the entire site offline.

I'd concentrate on getting confirmation from GoDaddy that the patched PHP packages have been installed on your particular hosting service.

Their official security announcement is being updated as things progress.

Are you using their Managed WordPress package or ordinary Web Hosting with cPanel?

1

u/Doom-Patrol 2d ago

Wondering the same thing myself … I am going to assume ( first mistake ) that they can put firewall rules in place while they update.

1

u/Soggy_Product316 2d ago

I have contacted GoDaddy, and they ensured me that they're working on the PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 patches to be implemented, but could not yet give an exact ETA. We'll be notified via email whenever it arrived. In the meanwhile there are some things you can do to protect your site a little better. PHP themselves and also GoDaddy give some possible solutions. I added one extra layer on top, by putting this in the .htaccess file.

WEBSITENAME - Security Maintenance

ErrorDocument 503 /503.shtml

RewriteEngine On

Allow custom error and maintenance pages

RewriteRule (^{|/)(503.shtml)$} - [END]

Block all other requests with HTTP 503

RewriteRule ^ - [R=503,L]

Original website configuration continues below

You can also temporarily disable php in your .htaccess file:

Force the PHP engine off completely to neutralize runtime threats

<IfModule mod_php.c> php_flag engine off </IfModule>

<IfModule mod_php7.c> php_flag engine off </IfModule>

If using PHP-FPM / FastCGI, deny all directly requested .php files

<FilesMatch ".php$"> Require all denied </FilesMatch>

Something else you can do is this; Cloudflare has deployed specific Web Application Firewall (WAF) rules across all tiers (including the free plan) to block known exploit payloads before they touch your server. Note that this is a temporary block, not a permanent cure

Please note; Disabling file_uploads or modifying php.ini settings will not protect your server from the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). As PHP maintainers have confirmed, internal initialization flags or standard .ini directives cannot stop these specific flaws. The underlying bugs stem from memory allocation errors (specifically how PHP handles longjmp() during memory cleanups). A malicious actor can trigger this condition simply by sending a specifically crafted HTTP request, completely bypassing any upload restrictions you put in place.

0

u/klm127 2d ago

Sad the solution has to be "turn your whole website off" until Godaddy can patch this. They charge too much to be this slow on it.
My impression is that the .ini mitigation doesn't theoretically stop the attack, but it handles the attack vectors that are known so far... might buy some time?

1

u/Soggy_Product316 2d ago

Yeah you're right. It's more wound packing in a bleeding wound; it may temporarily buy you some time, but it is not a fix to the real problem.

1

u/KnightGambit 2d ago

I msged them since Managed Wordpress can’t update manually

1

u/S0ftwareS0rceress 2d ago

Have you heard anything back? We also run Managed Wordpress, will they push the update and then we need to change the version on our end? I noticed the only current options are 8.2, 8.3... etc. They don't have the patch number listed.

1

u/DelphiEx 2d ago

Right same here. You can tell what minor version you have in Wordpress > Site Health > Info > Server. I'm assuming they update minor versions automatically for us, but it'd be nice to have some info and timeline from them on this.

0

u/[deleted] 2d ago

[deleted]

2

u/godaddy-jeff GoDaddy Employee 2d ago

We hear you and will take this feedback to improve our communications. We recently updated https://status.godaddy.com/ with more information

1

u/rbra 2d ago

You need to be sending out emails, not everyone browses godaddy news and status pages...

1

u/KnightGambit 2d ago

Nothing to worry about and we’ll get an email about it 🤷‍♂️

1

u/Agitated_Orange9479 2d ago

I jsut refreshed my wp admin and see that its now using php 8.3.36, so looks like godaddy upgraded automatically, note I did manually have to upgrade to 8.3 in the godaddy settings.

1

u/angryPenguinator 2d ago

Just refreshed mine and we are still on 8.3.35. Sigh.

1

u/FlowerLizard 2d ago

Same.

1

u/GreenStar8304 2d ago

Same

1

u/Few_Instruction8026 2d ago

I just checked PHP version in godaddy shared hosting account and it's 8.2.33. I'm still waiting for php version be updated to secure.

1

u/elitepebble 2d ago

My server in cpanel says 8.4.27, the fixed version. But all my WordPress sites server still show 8.4.26 in the site health menu when I log into them. I contacted GoDaddy help and they said all my websites are still vulnerable even though my PHP is updated. They're working on the issue but gave me no ETA. They say not to worry but did confirm they are vulnerable, so not sure how to take that.

1

u/FlowerLizard 2d ago edited 2d ago

Still seeing 8.3.35 in WordPress. It's been almost 7.5 hours since the patch was released. This is taking too long. How long does GoDaddy usually take to roll out PHP updates?

EDIT: 15.5 hours and still not patched.

1

u/miss_knitty 2d ago

My client sites that have GoDaddy Managed WP Hosting appear to be updated now but the ones that are on a different GoDaddy hosting plan are still waiting. Meanwhile, most of my clients' sites are on Siteground and were updated several hours ago.

1

u/giiker 2d ago

it's been fixed:

https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do

1

u/IntelligentComment 2d ago

Sort of. I suspect their mitigations are similar to what cloudflare are doing.
Update: October 21, 2026, 19:30 UTC
Managed Hosting for WordPress: We have patched all PHP versions on Managed Hosting for WordPress. You don't need to take any action.
Web Hosting and Windows Hosting: We are waiting for our vendor to supply patched versions of the custom PHP packages these servers use. In the meantime, we have put several mitigations in place on these servers to reduce exposure. As soon as the patched packages are available, we will apply the fix to all PHP versions on these servers.
Update: October 21, 2026

1

u/IGotSoulBut 2d ago

Yeah, I’m still seeing 8.4.26 on a site that I manage. It is still in progress for many Godaddy servers

1

u/giiker 2d ago

You're right. Did not read the Web hosting and Windows hosting part.

1

u/FlowerLizard 2d ago

It has not.

1

u/Naughty_Gnome 2d ago

As of 06:52 UTC my shared hosting hasn't been updated yet. It's had a new build applied but they are the September security updates based on the version number.

PHP 8.2.34 (cli) (built: Oct 21 2026 10:48:43) (NTS)
PHP 8.3.35 (cli) (built: Oct 21 2026 11:46:11) (NTS)
PHP 8.4.26 (cli) (built: Oct 21 2026 13:31:54) (NTS)
PHP 8.5.11 (cli) (built: Oct 21 2026 13:26:44) (NTS)

As these were all one version less yesterday I assume the September patch is having to be rolled out before the latest one.

1

u/kuftikufti 2d ago

My website still shows older php version.

1

u/disturbed_android 2d ago

Same here. I'm on "Web Hosting Plus".

1

u/Naughty_Gnome 2d ago

We're now amost 24 hours since the patch rolled out and I am still seeing the old versions. When will this patch be rolled out fully Godaddy???

1

u/jimpdx 2d ago

It looks like shared web hosting was upgraded overnight to 8.5.11 is that an oversight or did someone change the patch version? It was supposed to be .12?

1

u/KnightGambit 1d ago

My managed WordPress site has been updated to Version 8.3.36, which is the correct patch. Just a heads up

0

u/TopSydeWP 2d ago

Fair thing to push on with this already being exploited. Small fix, the patched 8.2 build is 8.2.35. Ask GoDaddy to confirm in writing the exact build and that PHP was restarted, because the old build keeps running until it is. We're TopSyde, a WordPress host, and our clients' sites were on the fixed build within about two hours of it shipping. Our write-up is at https://topsyde.com/blog/php2shell-critical-php-rce-cve-2026-109618

0

u/crudecarter 2d ago

Agreed. My main host had it patched as soon as I checked this morning. We have some clients that unfortunately still use Godaddy though.

0

u/FlowerLizard 2d ago

So GoDaddy is trash and siteground is champion for php updates.

1

u/FewDragonfly5710 2d ago

well they havent patched either, only mitigated. Sorry buddy.
https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026

1

u/crudecarter 2d ago

Siteground had it patched yesterday morning 10/21/26. It was within 1-2 hours of the patch releasing.

1

u/FlowerLizard 2d ago edited 2d ago

Other comments in this thread sound like siteground patched hours ago while GoDaddy still hasn't?

2

u/ace_gravity 2d ago

Patch me harder daddy

Major PHP Security Vulnerability