At Still N Motion Media Design, protecting our clients’ websites and online presence is a priority. Whenever a significant security issue is reported by one of our hosting or technology partners, we review the information and share relevant updates so our clients can stay informed and confident about their online services.
Recently, two separate security-related issues involving GoDaddy and the broader web hosting industry have received attention. While the details sound concerning, the good news is that both situations have been addressed, and there is currently no indication that websites managed through GoDaddy’s hosting environment were broadly compromised.
1. GoDaddy Reports AI-Driven Cyberattack
On October 28, 2026, GoDaddy disclosed that it experienced what it described as an AI-driven cyberattack involving its Websites + Marketing platform.
According to GoDaddy, an unauthorized third party used an API to access limited customer account information, including usernames and Shopper IDs. GoDaddy stated that passwords were not exposed, customer accounts were not accessed, and no changes were made to websites, hosting services, domains, or products as a result of the incident.
Additional reporting regarding the incident indicates that certain profile and website contact information may also have been exposed. Because investigations can evolve over time, website owners should monitor official GoDaddy communications for any updates.
GoDaddy further reported that:
- The incident was detected and contained.
- Law enforcement was notified.
- Cybersecurity experts were engaged to assist with the investigation.
- Notifications were provided to the Federal Trade Commission (FTC) and European data protection authorities.
- Additional security measures have been implemented to help prevent similar attacks in the future.
What This Means for Website Owners
While there is no indication that websites themselves were compromised, exposed account or contact information could potentially be used by cybercriminals to conduct phishing attempts.
We recommend:
- Enabling Two-Step Verification (2SV) on all GoDaddy accounts.
- Being cautious of unexpected emails, phone calls, or text messages claiming to be from GoDaddy.
- Never sharing passwords, verification codes, or payment information in response to unsolicited requests.
- Logging into GoDaddy directly through the official website rather than clicking links in unexpected messages.
2. Critical PHP Vulnerabilities Patched Across the Hosting Industry
Separately, the web hosting industry recently responded to two critical PHP vulnerabilities that affected web servers worldwide.
PHP is one of the most widely used web technologies on the internet and powers platforms such as WordPress. These vulnerabilities reportedly carried a CVSS severity rating of 9.2 out of 10 and had the potential to allow unauthenticated remote code execution on vulnerable servers.
Potential risks included:
- Website defacement
- Unauthorized access to sensitive information
- Malware installation
- Full server compromise
Because of the severity of these vulnerabilities, hosting providers across the industry worked quickly to implement security updates.
GoDaddy’s Response
Like many hosting providers, GoDaddy implemented security updates to help protect its infrastructure and customers.
GoDaddy has reported that security patches were automatically applied to its managed hosting and Windows hosting platforms. Clients using GoDaddy-managed hosting services should benefit from these updates without needing to manually patch their hosting environment.
Organizations running unmanaged servers or Virtual Private Servers (VPS) remain responsible for maintaining and updating their own software. Those environments should be reviewed to ensure the latest PHP security updates have been installed.
What We’re Doing for Our Clients
As part of our ongoing website maintenance and security practices, we continue to:
- Monitor vendor security notifications and advisories.
- Review hosting and domain security settings.
- Verify account access and security controls.
- Encourage the use of Two-Step Verification wherever available.
- Keep websites, plugins, themes, and supporting technologies up to date.
- Review unusual activity reports and security alerts when they occur.
At this time, we have not identified any indication that client websites managed by Still N Motion Media Design have been affected by either of these events. Based on the information provided by GoDaddy, websites, hosting services, and customer accounts were not accessed during the reported cyberattack.
The Bottom Line
Security news can sometimes sound alarming, especially when terms like “cyberattack” or “critical vulnerability” are involved. The most important takeaway is that GoDaddy reports the incident has been contained, security updates have been applied where necessary, and we continue to monitor the services we manage on behalf of our clients.
Staying informed, enabling Two-Step Verification, and maintaining current software updates remain some of the most effective ways to protect your online presence.
If you have questions about your website, GoDaddy account, hosting environment, domain security, or account settings, we’re always happy to help.
Disclaimer
A Note on Security Information: We strive to keep our clients informed of important security developments affecting their websites and online services. The information shared here is based on statements, notifications, and reports available at the time of publication, including information provided by GoDaddy. Security investigations and remediation efforts can evolve as additional information becomes available. We encourage clients to review official communications from their service providers and contact us if they have questions about their specific website, hosting account, domain registration, or security settings.