Is PHP2Shell fixed on Hostinger?

Status as of October 26, 2026: Hostinger reports patching PHP on its managed plans (confirmed in two of its own documents).

The short answer

Hostinger reports patched builds rolled out, completed Oct 22, 2026 06:44 UTC: All hosting plans except VPS (Web, Cloud, Agency, cPanel). VPS: not patched by Hostinger; VPS customers manage PHP themselves. We found two of the host’s own documents saying so. A host’s statement covers its managed platform, not a server you run yourself (source: GoDaddy). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on Hostinger

How to check on Hostinger (read-only)

Hostinger’s test is the PHP Build Date: October 21, 2026 or later, shown in a phpinfo() page (delete it straight afterwards). On a VPS, check the server itself.

If someone else runs your server, ask them in writing: the questions and a copy-ready email. If it’s your own VPS or server, nobody patches PHP for you; check it with the steps for your Linux distribution in the status table. (source (source: GoDaddy))

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On Hostinger: Hostinger says it switched off session upload progress on its LiteSpeed, PHP Selector and cPanel PHP-FPM setups and on phpMyAdmin, and that this covers CVE-2026-115560. VPS customers should set session.upload_progress.enabled off in php.ini or the PHP-FPM pool and restart PHP workers; Hostinger notes that ini_set won’t work. (Hostinger, Hostinger)

Notes for Hostinger

• Hostinger says the version number may not change on managed hosting. Its check is a PHP Build Date of October 21, 2026 or later.
• Your host may have patched PHP: Hostinger said it did. Ask for written confirmation for your account (source: GoDaddy).

Sources (checked October 26, 2026)

• Hostinger: Protecting you from PHP2Shell. Page date: Oct 21, 2026; updated Oct 23, 2026 13:25 UTC. States: Every hosting plan except VPS protected; rollout completed Oct 22 06:44 UTC; the version number may not change, check a Build Date of Oct 21, 2026 or later; session upload progress switched off on LiteSpeed, PHP Selector, cPanel PHP-FPM and phpMyAdmin; VPS customers update PHP or set the setting and restart workers; CVE-2026-115560 addressed by that setting.
• Hostinger: Status: PHP Security Update for Web, Agency and cPanel Hosting. Page date: Oct 21, 2026 17:44 UTC to Oct 23, 2026 12:53 UTC. States: PHP upgrades complete across all managed hosting servers (Oct 22 06:44 UTC); CVE-2026-115560 update Oct 23 12:53 UTC; VPS customers manage PHP themselves.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

GoDaddy · SiteGround · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.