No SSH?
Ask for the evidence.
Your host manages the runtime. Ask a precise question, keep its response, then recheck what is still unconfirmed.
Send this through your host's private support channel
Please confirm PHP2shell remediation for my hosting account: 1. What exact PHP package/build is serving my website, and who supplies it? 2. Which advisory confirms that this build fixes BOTH CVE-2026-109618 and CVE-2026-109619? 3. If my displayed PHP version has not changed, what is the full patched package revision or backport build identifier? 4. Have all relevant PHP-FPM pools, Apache/LiteSpeed workers and containers serving my account been restarted or replaced with the patched build? How was the active runtime checked? 5. Is your statement confirming the PHP patch, a WAF mitigation, or both? Does it apply to my plan and server? Please provide the advisory link, exact build and rollout/runtime confirmation. I do not need to send credentials, a complete phpinfo page or server logs.
You can print this page or use the interactive checker to generate a checklist for your answers. This site does not send the request for you.
How to read the reply
| Host reply | What remains to check |
|---|---|
| “Our firewall protects you.” | Ask separately whether PHP itself has both fixes. |
| “PHP was rebuilt yesterday.” | Ask for the build identifier and advisory. A date alone is insufficient. |
| “We installed the update.” | Ask whether all live Web workers were restarted/replaced and checked. |
| “We backported it.” | Match exact package/build, OS release, both CVEs and your plan/server. |
Keep the scope precise
Hostinger's 22 October update says it installed PHP's fix across its managed hosting plans, while VPS customers manage their own updates. That distinction illustrates why a provider name alone is not enough. Ask about your specific product and account; this site does not independently verify a provider's rollout.
Updating WordPress itself is separate from updating PHP. On a self-managed server, follow your distribution or image vendor's security update process and have the administrator check all relevant runtimes.
Sources: Hostinger's update, PHP security announcement, Ubuntu USN-8948-1.