A critical PHP security update has prompted an understandable question for business owners: does this affect my website, and has it been dealt with?
If your website runs on WordPress, it uses PHP. However, seeing that WordPress and your plugins are up to date doesn’t confirm whether this issue has been addressed.
Here’s what the announcement means, what we can confirm for Greenlight Web managed hosting clients, and what to ask if your website is hosted elsewhere.
What is the PHP security update about?
On 21 October 2026, WordPress published an announcement about a PHP release addressing two critical security vulnerabilities.
PHP runs on the server behind your website. These vulnerabilities concern that underlying technology and are not exclusive to WordPress.
WordPress advises website owners to check with their hosting provider and ensure the necessary PHP updates are applied promptly. It also confirms that no WordPress update is required to resolve these particular issues.
Read the official WordPress announcement about the critical PHP security release.
Have Greenlight Web’s hosting providers applied the patches?
Both managed hosting providers we use have confirmed they have applied the patches for this issue.
For clients whose websites are hosted through these providers as part of our managed hosting arrangements, this provides reassurance that the PHP security update has been addressed at hosting level.
If Greenlight Web maintains your website but your hosting is arranged separately, contact our team so we can help establish who is responsible for checking its patch status.
Why website maintenance includes your hosting
Most business owners interact with their website through its dashboard. That makes it easy to associate maintenance with updating pages, plugins and themes.
However, your website also depends on the environment in which it runs.
A useful way to review your arrangements is to ask who looks after each part:
- Website software: who maintains WordPress, plugins and themes?
- Hosting: who manages the server environment and PHP updates?
- Backups: who checks that backups are available and can be restored?
- Support: who do you contact when a security announcement needs attention?
These responsibilities may sit with one provider or several. What matters is knowing who owns each task and being able to get a clear answer when needed.
What should you ask your hosting provider?
If your website is hosted elsewhere, send your provider a straightforward question:
“Has the latest critical PHP security update been applied to the environment hosting our website?”
You can also ask whether your site uses a supported PHP version and who handles future security patches.
If the answer is unclear, request written confirmation of the action taken or the steps still required. A general statement that your website is “up to date” may not explain whether the hosting environment has been checked.
Where can you find your website’s PHP version?
In WordPress, go to:
Tools → Site Health → Info → Server
This shows the PHP version your website is running. Share that information with your hosting provider if you need help confirming its update status.
Frequently asked questions
Does WordPress use PHP?
Yes. WordPress uses PHP to run key website functions. This means PHP security updates are relevant even when WordPress, plugins and themes are already up to date.
Will updating WordPress fix these PHP vulnerabilities?
No. These vulnerabilities affect PHP itself. The patches need to be applied to the hosting environment, so check with your hosting provider.
Who is responsible for updating PHP?
This depends on your hosting agreement. In a managed hosting environment, the hosting provider generally manages PHP patching. If you manage your own server, responsibility may sit with your technical team.
Have Greenlight Web’s hosting providers applied the patches?
Both managed hosting providers we use have confirmed they have applied the patches for this issue. If we maintain your website but your hosting is arranged separately, contact us for help checking its status.
Does this announcement mean my website has been hacked?
No. A vulnerability announcement does not mean your website has been compromised. It does mean you should confirm that the necessary patches have been applied.
Need help understanding your website’s hosting and maintenance?
You shouldn’t need to interpret every technical security announcement to work out who is looking after your business website.
Greenlight Web can help you understand your current hosting and maintenance arrangements, identify questions that need answering, and discuss ongoing support.
Contact Greenlight Web with your website address and any information you have from your hosting provider. We’ll help you work out the next step.
