On October 21, 2026, two major security vulnerabilities were patched in PHP, the programming language used by WordPress. This announcement raised concerns among many website owners.
Good news for Farweb clients: we are closely monitoring the situation, and the necessary security patches are being handled in coordination with the relevant hosting providers. Here’s what you need to know.
What Happened with PHP?
PHP is a programming language that powers WordPress. It plays an essential role in displaying pages, managing content, and handling interactions with your website.
On October 21, the PHP development team released several updates to address two critical security vulnerabilities.
Under certain conditions, these vulnerabilities could allow an attacker to execute code on a server without having to log in.
While this is a serious issue, it does not mean that all WordPress websites have been compromised. Security patches have been released and can be deployed by hosting providers to protect affected environments.
Your Hosting Provider Plays a Key Role
Most of the WordPress websites we manage are hosted on shared hosting environments.
This means that the technical management of the server, including PHP security updates, is handled directly by the hosting provider.
When a vulnerability like the one discovered on October 21 is identified, hosting providers can apply the necessary security patches to their infrastructure without requiring direct intervention on each individual WordPress website.
However, it is still important to verify that these updates have been applied. On some private servers or specific hosting infrastructures, this responsibility falls to the server administrator or the company’s IT department.
Infomaniak: Security Patches Already Deployed
At Farweb, we regularly recommend Infomaniak, a Swiss hosting provider we have been working with for several years.
Following this security alert, Infomaniak confirmed that the necessary patches had been deployed across its shared hosting infrastructure and Cloud Servers, including for several older PHP versions.
One important detail: security patches can be applied without changing the PHP version number displayed in the hosting control panel. An older version number does not necessarily mean that the server is vulnerable.
Beyond this incident, we particularly appreciate Infomaniak for its transparent documentation, the quality of its management tools, and the clear visibility it provides into the hosting environment.
It remains a hosting solution we confidently recommend for WordPress projects.
What About Websites Maintained by Farweb?
If your website is covered by our WordPress maintenance service, you don’t need to take any specific action.
We are monitoring this security alert and following up on the necessary updates with the relevant hosting providers.
For websites hosted by Infomaniak, the security patches have been confirmed by the provider. For other hosting environments, particularly private servers or infrastructures managed by external IT departments, we are reviewing the available information and following up where necessary.
This incident is also a reminder that WordPress security goes beyond simply updating WordPress itself and its plugins. It also depends on a properly maintained hosting environment, regular backups, and appropriate security monitoring.
This is precisely why ongoing technical support and maintenance are so important.
Have Questions About Your Website’s Security?
Website security requires regular attention, even when everything appears to be running smoothly.
If your website is maintained by Farweb and you have any questions about this security alert, your hosting environment, or your PHP version, we’re here to help as part of your WordPress maintenance service.
And if your website is not yet maintained by our agency, we can also advise you on the best practices to keep your WordPress environment secure in the long term.
Discover our WordPress maintenance plans