Urgent PHP Updates: How to Proceed Safely
Author: Domeny.ForSale editorial team Published
In brief: If security patches have been released for the version of PHP your website uses, plan to apply them urgently. First, identify the PHP version running your site, make a backup and check the site’s compatibility with the update. The details of the advisory identified as published on 20 October 2026 must be confirmed on the official PHP website. Without verifying its contents, it is not possible to reliably identify specific vulnerabilities or the release numbers that fix them.
What a PHP update changes on your website
PHP is a runtime environment that executes application code on the server. It is used by WordPress, among others, as well as many online shops and custom-built applications. Updating WordPress does not automatically update PHP: they are separate components, usually managed in different places.
A vulnerability in PHP may affect a particular mechanism, extension or way of processing data. Its significance depends on the server configuration and how the application works. Using PHP does not in itself prove that a site has been attacked, but the absence of visible problems does not confirm that it is secure either.
In the official PHP advisory, check above all which versions are affected, which releases contain fixes and whether exploiting the vulnerability requires a particular configuration. If you cannot assess these conditions, forward the advisory to your administrator or hosting provider’s support team. Do not base your decision solely on a brief report of a “critical vulnerability”.
How to check which PHP version your website uses
The simplest approach is to open your hosting control panel and find the PHP settings assigned to the specific domain. In WordPress, you can also find server environment details on the Info tab of the Site Health tool. Check each important website separately: different domains on the same account may use different versions.
If you have terminal access, the php -v command will show the PHP version available on the command line. This is not necessarily the same version that runs the website. Compare the result with the site’s configuration in the control panel, or ask your administrator to confirm it.
Do not publish a publicly accessible file containing the phpinfo() function. It exposes configuration details that should not be available to casual visitors. If you created such a file for diagnostic purposes, delete it after checking the environment.
What to ask your hosting provider to do, and what to do yourself
On shared hosting, the provider usually installs PHP patches. However, you may still be responsible for selecting a supported PHP release branch and ensuring application compatibility. A newer version appearing in the control panel does not mean your domain is already using it.
You can send the support team a short message:
Please confirm which PHP version runs my domain and whether it includes the fixes from the PHP advisory identified as published on 20 October 2026. If a version change is required, please specify an available, supported version and explain how to restore the previous configuration if problems occur.
On your own VPS or dedicated server, the administrator performs the update unless it is covered by a managed service. They should check the PHP packages, the extensions in use and the processes serving the website, such as PHP-FPM. Operating system distributions may supply patches without changing the version number to match the latest PHP release. In that case, the package provider’s security advisory serves as confirmation.
A safe update, step by step
Applying a patch within your current PHP release branch is different from moving to another branch. The latter may require changes to code, plugins or server extensions. Do not simply choose the highest version number available in the control panel.
- Back up your files and database. Make sure you know how to restore the site and can access the backup even if there are problems with your hosting.
- Check application compatibility. Verify the requirements of your system, theme, plugins and libraries. Update dependencies where necessary.
- Test the change on a copy of the site. The test environment should match production as closely as possible. Disable real payments and messages to customers in that environment.
- Deploy the update at an agreed time. If a vulnerability is being actively exploited, do not put off action just to wait for the ideal maintenance window.
- Check functionality and error logs. Test login, forms, outgoing email and scheduled tasks. For an online shop, also test the cart and payments in test mode.
For example, a shop’s homepage may look fine after an update, while an old payment plugin fails only when a customer places an order. Simply opening the website is not enough to consider the deployment successful.
What to do if your site is incompatible with a secure version
Reverting to the previous configuration may temporarily restore functionality, but it does not remove the vulnerability. If you roll back the change, set a deadline for fixing the application at the same time. Depending on the threat, your administrator may recommend temporarily disabling the vulnerable feature, restricting access or taking the site offline for maintenance.
Updating PHP does not undo the effects of an earlier compromise either. Unknown administrator accounts, modified files or suspicious redirects call for a separate security review.
Your first practical step: identify the PHP version running your domain today and obtain confirmation of whether it includes the required patches. Only then decide whether to install a patch, switch to another PHP release branch or urgently fix an incompatible application.
See also: Does changing the domain of an existing project make sense?
Read also
