Who Is Responsible for PHP Updates: You, Your Host or Your Developer?

Key takeaways

• The owner starts it, the host usually does it. WordPress.org says updating PHP means either using your host's settings or asking your provider to do it. Either way, you are the one who has to make sure it happens.
• Your host decides which versions you can pick. WordPress.org says the hosting company determines which PHP versions are available to you.
• Patched builds exist for four branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. In its 21 October 2026 advisory, php.net calls an upgrade the one full remedy, and states the project ships nothing official for PHP 8.1 or earlier.
• Four jobs, four names. Choosing the version, applying it, testing the site and confirming in writing are separate jobs. In most setups they sit with different people.
• "Confirm in writing" is the job most often missed. A short written reply from the host or developer is your proof, and it costs nothing to ask.
• No setup removes you from the chain. Even when someone else does the work, you are the person who notices that nothing has happened.

Want the flaws themselves explained first? Our main PHP vulnerability of October 2026 article does that.

The four jobs inside one PHP update

People say "update PHP" as if it were one task. It is four, and the confusion usually sits in the gaps between them.

1. Choose the version. Pick a supported release that is at or above the fixed patch level for its branch. As of now WordPress.org suggests running PHP 8.3 or a later release.
2. Apply the update. Switch the server to the chosen PHP version. That happens in a host panel, through the host's staff, or by hand on a server you run yourself.
3. Test the site. Check that the home page, forms, login, admin and any shop still work. WordPress.org says themes and plugins should be tested on the new version.
4. Confirm in writing. Someone states which version the site now runs and that the security fix is in. php.net warns that some vendors backport fixes, so a number alone may not tell the whole story.

WordPress.org's update page also says to back up first, and to update WordPress, themes and plugins before the PHP change. Each of those steps is explained in checking and updating PHP on WordPress.

Who does what, by setup

WordPress.org's pages do not say who handles updates on each kind of plan, so the table below is a general guide to how these setups usually work, not a quote from any host. Your own plan page, contract or support reply decides it for your site.

Two points sit behind the table. The word "managed" on a plan page can mean different things, so ask what is included. Our comparison of managed WordPress hosting and shared hosting goes into that. Also, a host that updates PHP does not test your plugins for you. That part stays with you or your developer in almost every setup.

What each setup looks like in practice

Shared hosting

WordPress.org says many hosters let you change the PHP version yourself. If your host offers a switch, the job is yours: pick the version, change it, and test. If there is no switch, you ask the host. To find the number, see how to check your PHP version in cPanel or the command line.

VPS or your own server

You, or the person you pay to run the server, are the host. Per php.net, Linux distributions and long term support vendors were given the patches ahead of release. Look at your vendor's package list for updated builds. WordPress.org advises that anyone on their own server with a PHP release older than 8.2 think about pulling the site offline until the update is done. This setup carries the most work and the most freedom.

Freelancer built site

Many freelancer builds end at launch. Hosting may sit in your name, with nobody assigned to look after it. If that is you, treat the developer as someone you hire for the update, not someone who already owes it. Our guide on what to check before you hire someone to update PHP helps you judge an offer.

Questions to send, in plain text

Paste these and edit the first line. They are written so that a short reply is enough. Leave out any logins, never send a password in a message, and use the host's own support ticket or the developer's usual channel.

To your web host

1. What PHP version is my site running right now? Please give the full number, for example 8.3.36.
2. Has my plan received the fix shipped in the 21 October 2026 PHP security release? If you backport fixes and keep the old number, please say so.
3. If it is not applied, on what date will it be?
4. Can I change the version myself in the panel, or do you do it?
5. If I switch and the site breaks, can you set the old version back quickly?
6. Please reply in writing so I can keep it with my records.

For a longer set of questions, plus a description of what a good reply looks like, read our web host questions about the PHP security fix.

To your developer or agency

1. Is PHP updating part of what I already pay for? If not, what is the scope of a one off job?
2. Will you take a full backup before any change?
3. Will you update WordPress, the theme and plugins first, and tell me which plugins cause trouble on the newer PHP?
4. Which pages will you test afterwards, including forms, login and admin?
5. Which PHP version will the site run when you finish?
6. Can I have a short before and after note in writing?

If nobody answers, or the answers disagree

Silence is common, so it helps to know what to do next.

For sites on PHP 8.1 or older, php.net says the project no longer updates these versions, and that some vendors offer backported fixes. The choice is weighed in PHP end of life dates. The same advisory notes that PHP 8.2 reaches end of life on 31 December 2026, so aim higher than 8.2 if you are updating anyway.

What is still unclear

• Plan wording. Every host words its plans differently, and the hosting page at WordPress.org is silent on who carries out updates. We did not read any host's terms for this guide, so we cannot say what any plan covers.
• Backported fixes. A host may patch the flaw yet leave the old version number on display. A written confirmation matters for that reason, and a version check alone can mislead.
• Old agreements. If your maintenance agreement predates October 2026, it may not say whether urgent security work is included. Ask.
• When this advice does not apply. Sites on a hosted builder, or on a static host where PHP does not serve the pages, have no PHP of their own to update. Our guide to whether Webflow runs PHP explains one case.

How we help at Amariq

When nobody is sure whose job PHP is, we take it on as a clearly scoped task with a start and an end. Within a day of the advisory we handled WordPress sites this way, and every job ended with a written record of what was changed. The same job can be booked via our WordPress PHP update gig on Fiverr. Where the host has to act, we contact them too and ask for confirmation. Our Webflow maintenance page covers ongoing care on that platform. Public reviews from past clients sit on Fiverr and Upwork, and you can see how we work on our YouTube channel.

Frequently asked questions

Is my web host responsible for updating PHP?

Partly. According to WordPress.org, the host controls the list of PHP versions on offer. You then switch inside the host's settings, or you request the switch from the host. Whether the host does it for you without being asked depends on your plan, so ask.

Does managed WordPress hosting update PHP for me?

Many managed plans handle the server side, but the wording differs, and we have not checked any plan's terms. Ask which PHP version your site runs and whether the 21 October 2026 fix is in. Plugin testing usually still sits with you.

Who is responsible if my site is hacked because PHP was not updated?

We cannot answer that from a general guide. It depends on your hosting terms and any maintenance agreement, so read those and ask in writing. Our guide to checking a hacked WordPress site covers the practical steps.

My freelancer built the site. Do they have to update PHP?

Only if your agreement says so. Many projects end at launch. Ask whether a care plan exists, and if not, hire someone for a one off update.

What should I ask for to confirm the update was done?

Ask for the full PHP version number and a statement that the October 2026 fix is applied. If the host backports fixes, ask them to say that clearly. Keep the reply with your records.

Do I still need WordPress updates after the PHP update?

Yes, keep WordPress, themes and plugins current. WordPress.org notes that these specific flaws do not call for a WordPress update. Routine updates are still part of caring for any PHP site, though. See our note on WordPress minimum PHP requirements.