Is PHP2Shell fixed on Xserver?

Status as of October 26, 2026: Xserver reports patching PHP (one source; not confirmed in a second primary source as of October 26, 2026).

The short answer

Xserver reports fixes applied for PHP 5.1–8.5 on all target servers (completed by Oct 26, 2026, 06:20): Rental servers (XServer, XServer Business, XServer for WordPress). VPS (XServer VPS, VPS for Business, VPS Cloud): not patched by Xserver; customers check and update PHP. We found one primary source, the host’s own statement; a second wasn’t found as of October 26, 2026. A host’s statement covers its managed platform, not a server you run yourself (source: GoDaddy). A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on Xserver

How to check on Xserver (read-only)

On rental servers, ask Xserver support to confirm for your account. On a VPS, check the server itself.

If someone else runs your server, ask them in writing: the questions and a copy-ready email. If it’s your own VPS or server, nobody patches PHP for you; check it with the steps for your Linux distribution in the status table. (source (source: GoDaddy))

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On Xserver: Xserver’s notice doesn’t mention CVE-2026-115560.

Notes for Xserver

• On PHP 5.1 to 8.1, Xserver’s fix doesn’t change the version number. Those sites are patched for PHP2Shell but still on branches that get no official fixes (source: Beazley Security Labs; AlmaLinux).
• Your host may have patched PHP: Xserver said it did. Ask for written confirmation for your account (source: GoDaddy).

Sources (checked October 26, 2026)

• Xserver: 【重要】PHPの脆弱性（CVE-2026-109618/CVE-2026-109619）に関するお客様のご利用サーバー環境への安全対策について. Page date: Oct 21, 2026; completion stated as of Oct 26, 2026 06:20 (time zone not stated). States: Rental servers (XServer, XServer Business, XServer for WordPress): mitigations by Oct 21 12:00; after the fix release, fixes applied from PHP 8.2–8.5 and extended to end-of-support versions; all target servers on PHP 5.1–8.5 done by Oct 26 06:20; 8.2–8.5 updated to fixed versions in the same series, 5.1–8.1 patched without changing the customer’s PHP version; VPS not patched by Xserver. (The earlier notice, view_id=19734, now covers only Xserver’s own sites and panels.)

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

Sakura Internet · Lolipop · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.