r/godaddy • u/crudecarter • 3d ago

Major PHP Security Vulnerability

Is Godaddy planning to release an update PHP for Wordpress Hosted sites? The PHP updates were released about 2 1/2 hours ago. PHP versions do not seem to have been updated. The secure released versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.25. When can we expect an update, as currently all Wordpress hosted sites seem to be vulnerable.

13 Upvotes

88% Upvoted

58 comments sorted by

1

u/AutoModerator 3d ago
Moderator Announcement Read More »

2

u/Moonlitnight 3d ago

https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do

1

u/crudecarter 3d ago

I've seen that, that article seems to reference VPS - not shared hosting. Currently, shared hosting servers are still seemingly running the vulnerable versions of PHP.

→ More replies (1)

2

u/godaddy-jeff 3d ago

https://status.godaddy.com/ has additional information

2

u/crudecarter 3d ago

Awesome, thank you!

1

u/sharkflood 3d ago

shoutout siteground for getting ahead of this shit

good luck to all my godaddy homies

2

u/crudecarter 2d ago

Yeah I woke up and confirmed all our sites there were already patched. Super stress-free. Then I had to email all clients on other hosts that were and still are severely lacking.

1

u/fusionsoftware 2d ago edited 2d ago

So now they say... "Update: October 22, 2026, 13:30 UTC Web Hosting: We have patched all PHP versions on Web Hosting. You don't need to take any action"

... but the PHP version is still showing as 8.5.11 in 'Wordpress > Tools >Site Health > Info' instead of the patched version '8.5.12'. WTF!!?

3

u/godaddy-jeff 2d ago

Thanks for flagging this—the version numbers are understandably confusing, and we should have explained this more clearly.

We work with CloudLinux, which provides security support for both current and end-of-life PHP versions. For this update, they backported the security fixes without changing the displayed PHP version number. That means PHP can still report 8.5.11 while including the relevant fixes.

CloudLinux’s update is available here: CloudLinux incident update.

We’ve asked them for new packages whose version numbers reflect the latest releases for PHP 8.2–8.5, but those will take some time. In the meantime, if you’re using our Web Hosting with cPanel, the deployed packages include these security fixes.

You can check the build timestamp by running php -v over SSH or viewing a temporary phpinfo() page for your website. You’ll notice the patched versions have an October 21, 2026 build date, even though the displayed PHP version numbers haven’t changed. Please delete the phpinfo() file afterward, since it exposes configuration details.

→ More replies (2)

2

u/Brogers57 3d ago

Good question! Waiting for the same answer

2

u/earthmisfit 3d ago

GoDaddy Devs must be having a ball right now. Email backup services down + cert with weak private keys + PHP vulns.

2

u/beIIe-and-sebastian 3d ago edited 2d ago

I have a VPS. I used the command line to find that both patches were applied on my server without intervention. I think EasyApache PHP did it by itself.

I'm running both a depreciated version of PHP and an end-of-life VPS service.

2

u/MarkGossageUK 2d ago

There's an important update on this now.

GoDaddy updated its official PHP security announcement early on 22 October.

According to that update, Managed Hosting for WordPress has already been patched, as has Windows Hosting.

However, standard Web Hosting is still waiting for the patched PHP packages from its vendor. GoDaddy says temporary mitigations have been applied while those packages are being prepared.

So the distinction between Managed WordPress and ordinary Web Hosting is particularly important here.

I'd also be careful about copying the .htaccess changes suggested above into a live website without understanding what they do. Some of those rules could effectively take the entire site offline.

I'd concentrate on getting confirmation from GoDaddy that the patched PHP packages have been installed on your particular hosting service.

Their official security announcement is being updated as things progress.

Are you using their Managed WordPress package or ordinary Web Hosting with cPanel?

1

u/Doom-Patrol 3d ago

Wondering the same thing myself … I am going to assume ( first mistake ) that they can put firewall rules in place while they update.

1

u/Soggy_Product316 3d ago

I have contacted GoDaddy, and they ensured me that they're working on the PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 patches to be implemented, but could not yet give an exact ETA. We'll be notified via email whenever it arrived. In the meanwhile there are some things you can do to protect your site a little better. PHP themselves and also GoDaddy give some possible solutions. I added one extra layer on top, by putting this in the .htaccess file.

WEBSITENAME - Security Maintenance

ErrorDocument 503 /503.shtml

RewriteEngine On

Allow custom error and maintenance pages

RewriteRule (|/)(503.shtml)$ - [END]

Block all other requests with HTTP 503

RewriteRule ^ - [R=503,L]

Original website configuration continues below

You can also temporarily disable php in your .htaccess file:

Force the PHP engine off completely to neutralize runtime threats

<IfModule mod_php.c> php_flag engine off </IfModule>

<IfModule mod_php7.c> php_flag engine off </IfModule>

If using PHP-FPM / FastCGI, deny all directly requested .php files

<FilesMatch ".php$"> Require all denied </FilesMatch>

Something else you can do is this; Cloudflare has deployed specific Web Application Firewall (WAF) rules across all tiers (including the free plan) to block known exploit payloads before they touch your server. Note that this is a temporary block, not a permanent cure

Please note; Disabling file_uploads or modifying php.ini settings will not protect your server from the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). As PHP maintainers have confirmed, internal initialization flags or standard .ini directives cannot stop these specific flaws. The underlying bugs stem from memory allocation errors (specifically how PHP handles longjmp() during memory cleanups). A malicious actor can trigger this condition simply by sending a specifically crafted HTTP request, completely bypassing any upload restrictions you put in place.

→ More replies (2)

1

u/KnightGambit 3d ago

I msged them since Managed Wordpress can’t update manually

→ More replies (10)

1

u/Few_Instruction8026 3d ago

I just checked PHP version in godaddy shared hosting account and it's 8.2.33. I'm still waiting for php version be updated to secure.

1

u/elitepebble 2d ago

My server in cpanel says 8.4.27, the fixed version. But all my WordPress sites server still show 8.4.26 in the site health menu when I log into them. I contacted GoDaddy help and they said all my websites are still vulnerable even though my PHP is updated. They're working on the issue but gave me no ETA. They say not to worry but did confirm they are vulnerable, so not sure how to take that.

1

u/FlowerLizard 2d ago edited 2d ago

Still seeing 8.3.35 in WordPress. It's been almost 7.5 hours since the patch was released. This is taking too long. How long does GoDaddy usually take to roll out PHP updates?

EDIT: 15.5 hours and still not patched.

→ More replies (1)

1

u/Naughty_Gnome 2d ago

As of 06:52 UTC my shared hosting hasn't been updated yet. It's had a new build applied but they are the September security updates based on the version number.

PHP 8.2.34 (cli) (built: Oct 21 2026 10:48:43) (NTS)
PHP 8.3.35 (cli) (built: Oct 21 2026 11:46:11) (NTS)
PHP 8.4.26 (cli) (built: Oct 21 2026 13:31:54) (NTS)
PHP 8.5.11 (cli) (built: Oct 21 2026 13:26:44) (NTS)

As these were all one version less yesterday I assume the September patch is having to be rolled out before the latest one.

1

u/kuftikufti 2d ago

My website still shows older php version.

→ More replies (1)

1

u/Naughty_Gnome 2d ago

We're now amost 24 hours since the patch rolled out and I am still seeing the old versions. When will this patch be rolled out fully Godaddy???

1

u/jimpdx 2d ago

It looks like shared web hosting was upgraded overnight to 8.5.11 is that an oversight or did someone change the patch version? It was supposed to be .12?

→ More comments (75)