Is PHP2Shell fixed on Lolipop?

Status as of October 26, 2026: Lolipop reports patching PHP on its managed plans (partly confirmed in two of its own documents).

The short answer

PHP’s fixed releases: 8.2.35, 8.3.36, 8.4.27, 8.5.12: PHP 8.2 to 8.5. PHP 7.4 to 8.1: the fix provided by PHP’s developers for end-of-life versions. PHP 5.3 to 7.3: a Lolipop-made fix based on the official one. We found two of the host’s own documents saying so. A host’s statement covers its managed platform, not a server you run yourself (source: GoDaddy). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on Lolipop

How to check on Lolipop (read-only)

Lolipop’s user page shows the PHP version per domain (PHP settings). Ask support to confirm the fix for your account.

If someone else runs your server, ask them in writing: the questions and a copy-ready email. If it’s your own VPS or server, nobody patches PHP for you; check it with the steps for your Linux distribution in the status table. (source (source: GoDaddy))

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On Lolipop: Both Lolipop notices say session upload progress is disabled for all PHP versions. Neither names CVE-2026-115560. (Lolipop, Lolipop)

Notes for Lolipop

• Lolipop recommends moving each domain to PHP 8.2 or later and testing forms and uploads. PHP 8.2 itself stops receiving security fixes on December 31, 2026, so 8.4 or 8.5 is the longer-lived choice (source: php.net supported versions).
• Lolipop’s two notices word the PHP 8.0 and 8.1 fix differently: the October 21 maintenance notice (updated October 22) says official fixed releases went to the PHP 8 series and 7.4; the October 22 report calls the 8.0 and 8.1 fix the developers’ code for end-of-life versions. We follow the later report.
• Lolipop said attempts that appeared to target the vulnerability were seen, but no unauthorized access or data leakage had been confirmed at the time of its report.
• Your host may have patched PHP: Lolipop said it did. Ask for written confirmation for your account (source: GoDaddy).

Sources (checked October 26, 2026)

• Lolipop (GMO Pepabo): PHPの脆弱性への対応に伴うメンテナンス完了と経緯のご報告. Page date: Oct 22, 2026. States: 8.2–8.5 on PHP’s fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12); 7.4–8.1 on the fix provided by PHP’s developers; 5.3–7.3 on a Lolipop-made fix; session.upload_progress disabled for all versions; attempts seen, no unauthorized access confirmed at this time.
• Lolipop (GMO Pepabo): 【完了】【重要】PHPの脆弱性への予防措置に伴うメンテナンス実施のお知らせ. Page date: Oct 21, 2026; updated Oct 22, 2026 16:57. States: Maintenance complete; official fixed releases applied to the PHP 8 series and 7.4; session.upload_progress disabled for all versions. Its wording on 8.0 and 8.1 differs from notice 8239.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

Xserver · Sakura Internet · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.