What Hightrees Hosting customers need to know
If you’ve seen the news about serious PHP security vulnerabilities, you may be wondering what this means for your website.
Patching across our hosting platform is complete, including security fixes for older PHP versions.
Here’s a straightforward explanation of what happened and what you need to know.
What is the PHP security issue?
PHP is software that runs behind the scenes on many websites, including WordPress.
Two critical vulnerabilities, commonly called PHP2Shell, could allow attackers to run malicious code on vulnerable servers without logging in. The PHP team released security updates on 21 October 2026 to address both issues.
You can view the official PHP advisory here
Has our hosting platform been patched?
The security update rollout across our hosting platform was completed on 21 October at 21:01 BST.
This includes the latest PHP security releases and fixes backported to older PHP versions. Backporting means applying a security fix to an older version without requiring a move to a newer PHP release.
Customers on this platform do not need to install these server updates themselves.
Do I need to update WordPress?
These vulnerabilities affect PHP itself. Updating WordPress or a plugin does not apply the PHP fix—the underlying hosting software needs to be patched.
WordPress has confirmed that no WordPress update is required for these particular issues. You can read the WordPress security announcement here
You should still keep WordPress, themes and plugins updated as part of normal website maintenance.
What if my website uses an older PHP version?
The completed rollout includes security fixes for older PHP versions. However, moving to a supported version remains sensible for ongoing maintenance and compatibility.
Before changing PHP versions, it’s important to check that your website, themes and plugins are compatible. Testing first can help avoid unexpected problems.
If you’re unsure which PHP version your website uses, or whether it will work with a newer version, we can help you check and plan the next step.
Does this mean my website was hacked?
A vulnerability announcement does not mean your website has been compromised. It means a weakness has been identified that needs fixing.
Patching addresses these vulnerabilities, but it does not establish whether a website was affected before the updates were applied. If you notice unexpected changes, unfamiliar administrator accounts or unusual website behaviour, contact us so we can help investigate.
Need help?
If you have questions about your hosting or want help checking your website’s PHP version, get in touch with Hightrees Hosting.
Practical advice, explained clearly—keeping IT simple.
