If you’ve seen the recent warnings about a critical PHP security patch, you might be wondering whether your website is affected—and what you need to do.
For most business owners using managed website hosting, your hosting company handles PHP security patches behind the scenes. You generally won’t need to install anything yourself.
However, it’s important to confirm that the work has been completed. The safest first step is to speak with your website hosting company.
What is PHP, and what does a patch do?
PHP is the programming language that WordPress runs on. It works on your hosting server, processing the code that helps generate your website’s pages and functionality.
Like WordPress and its plugins, PHP needs ongoing updates. A patch fixes a particular issue, which might involve a software bug or a security vulnerability.
The important distinction is where that update happens. PHP patches are applied at the server or web hosting level. They aren’t installed through the WordPress plugin updates screen.
Updating WordPress is important, but it doesn’t automatically update the PHP software underneath it.
What is the PHP security patch everyone is talking about?
On 21 October 2026, the PHP team released security updates addressing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619, commonly referred to as PHP2Shell.
These vulnerabilities could allow an attacker to run unauthorised code on an affected server. The PHP team urged users to update immediately, releasing fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting providers using vendor-maintained packages may deliver the fixes through their own patched builds.
For website owners, the practical takeaway is straightforward: this requires a server-level PHP update. Installing a WordPress plugin or updating your theme won’t apply the fix.
Will your web hosting company apply the patch?
If you use shared hosting or managed WordPress hosting, server software updates are generally handled by your hosting provider.
That means you will usually have no technical work to carry out yourself. For example, Wordify has confirmed that it applied the fixes across its platform, including the PHP versions it provides to customers.
However, providers have different processes and rollout times. Don’t assume that every hosting environment has already been updated.
A simple message to your host can remove the uncertainty:
“Can you confirm that the PHP security fixes for CVE-2026-109618 and CVE-2026-109619 have been applied to the PHP environment running my website?”
Your hosting company is best placed to check the server and confirm its patch status.
What if you use a dedicated server or VPS?
The responsibility depends on who manages it.
If your dedicated server or virtual private server comes with server management, your provider may handle the patch for you.
If it’s unmanaged, you or your server administrator may need to act urgently. Simply renting a server doesn’t necessarily mean the hosting company maintains the software installed on it.
If you’re unsure who is responsible, contact your hosting provider and ask. Make sure there is a clear answer about both ownership and completion of the update.
Keeping PHP current is only part of website maintenance
Security patches address specific problems. Keeping your website on a supported, compatible PHP version is the longer-term responsibility.
PHP versions eventually reach the end of their support life, meaning they stop receiving regular security updates from the PHP project. Staying on an old version can leave your website exposed to issues that no longer receive fixes.
Major PHP upgrades also need planning. Your WordPress installation, plugins, theme and custom code should be compatible with the version you move to.
The same ongoing attention applies inside WordPress. Keeping PHP updated doesn’t remove the need to maintain your plugins, themes and WordPress core. Each layer needs looking after.
Let Sympley take care of your WordPress maintenance
Here at Sympley, we help take the ongoing work of maintaining WordPress off your hands.
Our WordPress maintenance service includes plugin, theme and WordPress core updates, alongside security and backup management and ongoing support. We help keep your website maintained while you focus on running your business.
For this PHP alert, start by asking your hosting company to confirm the server has been patched. For ongoing help looking after your WordPress website, talk to Sympley about our WordPress maintenance service.
