GoDaddy PHP version: how to check it and GoDaddy's PHP2Shell status by plan

Is my GoDaddy site affected by PHP2Shell?

A GoDaddy site is affected by PHP2Shell if it runs a PHP build older than the fixed release for its branch and GoDaddy hasn’t patched it yet. PHP2Shell is two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. Who fixes it depends on your plan: GoDaddy for Web Hosting, Windows Hosting and Managed WordPress; you for a self-managed VPS or server. The fixed releases are:

The PHP2Shell checker explains how to read your version.

Has GoDaddy patched PHP for PHP2Shell?

GoDaddy says it has patched every PHP version on Managed WordPress and is still waiting for patched packages on Web Hosting, so Web Hosting was unconfirmed as of 22 Oct 2026. GoDaddy’s article Important PHP security update: What website owners need to do (published 20 October 2026, updated 21 October at 16:45 and 19:30 UTC) says:

• Managed Hosting for WordPress: GoDaddy patched all PHP versions. No customer action needed.
• Web Hosting and Windows Hosting: GoDaddy is waiting for its vendor’s patched custom PHP packages, has added mitigations to reduce exposure, and will apply the fix to all PHP versions once they arrive. No customer action needed.
• VPS with cPanel/WHM: Patched versions are in EasyApache 4; update through WHM or normal package updates, then restart PHP and the web server.
• Other VPS and self-managed servers: You update PHP yourself.

On 21 October at 18:29 UTC, GoDaddy’s status page incident Hosting Maintenance added that mitigations were in place and services including Web Hosting and Managed Hosting for WordPress were being patched. Mitigations lower exposure, but PHP states that only an update is a complete solution.

How do I check my PHP version on GoDaddy?

You check it in the hosting account’s settings; the path differs by plan.

Web Hosting (cPanel), per GoDaddy’s help article View or change the PHP version for my Web Hosting (cPanel):

1. Go to your GoDaddy product page.
2. Under Web Hosting, select Manage next to the account.
3. Open the Settings tab; PHP Version is in the Server Settings section.

Managed WordPress, per GoDaddy’s help article Change my PHP version: on My Products, click Manage All next to Managed Hosting for WordPress, open the site’s menu icon and select Settings; PHP version is under Production Site.

For the exact build, GoDaddy points to WordPress: Tools → Site Health → Info → Server. The PHP version checker explains the number.

How do I switch to a fixed PHP version on GoDaddy?

On shared and Managed WordPress plans, GoDaddy installs the fixed builds; you only choose the branch.

• Web Hosting (cPanel): In Server Settings, select Change next to PHP Version, choose a version, select Continue, then Save Changes (GoDaddy help).
• Managed WordPress: Under Production Site, click Change next to PHP version, choose the version and click Save Changes. GoDaddy suggests testing on a staging site first (GoDaddy help).

On a VPS, see change PHP version in cPanel or update PHP on Ubuntu.

What about WordPress sites on GoDaddy?

WordPress sites on GoDaddy are fixed through PHP, not through WordPress updates. Updating WordPress, themes or plugins doesn’t fix PHP2Shell. On Managed WordPress, GoDaddy says PHP is already patched; on Web Hosting, check Site Health again after GoDaddy applies the vendor packages. See PHP2Shell and WordPress.

What should I ask GoDaddy support?

Contact GoDaddy support if you’re on Web Hosting or Windows Hosting and want a date, or if a site still reports a version below the fixed release. Ask which exact PHP build the site runs, whether it includes the fix for CVE-2026-109618 and CVE-2026-109619, whether PHP was restarted, and when the vendor packages will be applied. A ready-made message is on the PHP2Shell patch page. Reach support from your GoDaddy account, not from links in unexpected emails.

What if my GoDaddy site runs old PHP?

GoDaddy says it will apply the fix to all PHP versions on Web Hosting and has patched all versions on Managed WordPress, but it does not list which older versions that covers. PHP publishes no new releases for 8.1 and older, only minimal source patches for 7.4, 8.0 and 8.1, so a version number alone can’t prove a fix. GoDaddy recommends moving to PHP 8.2 or later. See PHP end of life.