Critical PHP Security Update: What Freshy Clients Need to Know

Updated October 21, 2026: If Freshy hosts your website, the hosting-level security fixes for the recent critical PHP vulnerabilities have already been applied. No action is required from you.

If Freshy manages your website on a third-party hosting platform, that provider has likely already deployed the relevant update or backported the fix to its supported PHP packages. Major hosting providers have been actively rolling out these protections, and any remaining updates are expected very shortly. Freshy can verify the status with your specific host when needed.

Frequently asked questions

What happened?

PHP is one of the core underlying programming languages used to power a large portion of the internet, including platforms such as WordPress. It runs at the web-server level and is maintained separately from an individual website's content, design, plugins, and WordPress dashboard.

The PHP security team identified two vulnerabilities, disclosed them publicly and released fixes on October 21. Under certain server configurations, the vulnerabilities could allow an unauthenticated attacker to execute code remotely.

Freshy's server provider applied the required protections almost immediately after disclosure, while other major hosting providers have been deploying the official updates or backporting the same security fixes to the PHP packages they maintain.

Does the security advisory mean my website was hacked?

No. A vulnerability announcement means that a security issue was discovered in widely used software; it is not evidence that a particular website was compromised. As soon as it was announced most major hosting providers immediately began patching their infrastructure, closely monitoring incoming traffic and taking other mitigation steps to block malicious activity.

If there is a specific sign of suspicious activity, an alert tied to your website, or another reason for concern, Freshy can perform a targeted investigation. Routine WordPress, plugin, and theme updates remain important, but they are separate from this server-level PHP patch.

Is my Freshy-hosted website protected?

Yes. Freshy's server provider applied the required protections at the server level on October 21. You do not need to update PHP yourself, change your website, or take the site offline.

What if my website uses another hosting provider?

Since the disclosure, most major hosting providers have been busy deploying the official PHP updates or backporting the security fixes to the PHP packages they maintain. In most cases, the fix has already been applied as of October 21, or is in the final stages of rollout.

If Freshy manages your website but does not host it, our team can check the provider's status and follow up with the host if confirmation is not publicly available. Because PHP is managed at the server level, the third-party hosting provider controls the final deployment of that patch.

My scanner reports an older PHP version. Does that mean the site is still vulnerable?

Not necessarily. A displayed PHP version number alone does not confirm whether a server is vulnerable.

Hosting providers commonly use a process called backporting: they apply a security fix from a newer PHP release to an older PHP branch that they still support. The visible version may remain the same, or may not match the version named in the public advisory, even though the vulnerable code has been patched.

For that reason, the most reliable confirmation is the hosting provider's security notice or package status, not the version number reported by a website scanner. Freshy does not recommend changing to a new major PHP version solely to satisfy a scanner warning, because an unplanned version change can create compatibility problems for a website.

Do I need to take my website offline?

In almost all cases, no. If the host has applied the fix or confirmed an active mitigation, taking the website offline is unnecessary. If a third-party host cannot confirm protection, Freshy will review the situation and recommend the appropriate next step.

Do I need to run a malware or file-integrity scan?

Freshy-hosted websites already have several layers of security monitoring and protection in place, including continuous malware scanning. These protections operate alongside the server-level PHP patch and help us identify suspicious files or activity.

If your site shows unusual behavior or you receive a site-specific security alert, please send those details to Freshy so our team can review them and determine whether any additional investigation is appropriate.

For websites hosted by a third party, the exact security and scanning services depend on that provider. Since the vulnerability was announced, Freshy has been in active contact with any third party hosting companies our non-hosted clients may use, ensuring that patches are applied to any vulnerable versions of PHP. We are happy to help review the available protections for your specific site if needed.

Where can I read the official security notice?

PHP's official announcement is the primary source: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 security releases.

Still have questions?

If Freshy manages your website and you would like us to confirm its hosting status, contact the Freshy Help Desk. Please include the website address and any alert or scan report you received.