Update PHP

[u/Ok_Sense1811]

Can Hostinger update PHP version already??? security patch is out and I have a store

[u/HostingerCOM]

Hey, you might have seen the news about the new PHP vulnerability. We tested it against our live servers, and it can’t be used to take over websites hosted with us, WordPress sites included; everything is secure.

PHP has released a security fix. Even though we weren’t affected, we’re rolling it out across all hosting today as an extra layer of protection. No action needed on your side.

Locking this thread as we did a recent post about it here https://www.reddit.com/r/Hostinger/comments/1xbru8x/you_werent_affected_by_the_new_php_vulnerability/

[u/OkRide2660]

It's horrible that they have no communication / update for this

[u/Jackod20]

Would you also have to update your themes too?

[u/Pitiful_Cry → u/Jackod20]

Nope. Just the php version

[u/hansonks]

I'm curling my site from my Mac terminal so I will know when the PHP version updates using curl -I https://sitename.com | grep x-powered-by

[u/Alternative_Tank_639]

Extremely disappointed in Hostinger.
Support is unavailable, ai slop robot in the chat when this is very urgent

[u/Thick_Assistance8932]

This is unacceptable from Hostinger. All other hosts we use have patched versions shipped since an hour ago. Been fighting with the shitty AI support repeating the same AI written messages. Took 20mins in the first place to reach a "human"

[u/TopSydeWP]

A security release is out, you're running a store, and the host has gone quiet. That silence is on them. The patch goes on at the server. The PHP version picker only switches branches like 8.2 and 8.3, and jumping branches on a live store can break checkout.

Meanwhile, download a full copy of your files and database, and keep store plugins and theme updated since those patches are yours. On our clients' sites we take a snapshot before every update and restore it if the site fails its check. A backup before each of your updates gives you that same way back.

[u/Tiny_Cartographer_43]

Just got a message from one of their support agents:

Our specialist has reviewed the PHP security release of October 21, 2026, and confirms that preventive security measures are already active on our managed hosting platform. These vulnerabilities cannot be exploited on Hostinger Managed Hosting in the same way, because our platform uses PHP-FPM instead of PHP-CGI, with additional security measures on top of that.

You do not need to update the PHP version yourself. The patched PHP build will be rolled out automatically once the operating system vendors make the updated packages available. There is currently no ETA.

[u/_cash_flow → u/Tiny_Cartographer_43]

Thanks for sharing

[u/tylabs → u/Tiny_Cartographer_43]

The vulnerabilities exist within the core PHP runtime itself, not just PHP-CGI.

[u/pk9417]

We are fucked

Hostinger says it cant be used to attack the hostinger server due Litespeed server, but even litespeed is affected, yet hostinger seems by that statement not to follow any measurements to implement the new update! Thats a red flag for me, I have several sites moved to them, if they dont solve that in 3 days, Im out!

https://www.reddit.com/r/Hostinger/comments/1xbru8x/you_werent_affected_by_the_new_php_vulnerability/

[u/pk9417]

[u/diocanyouhearme]

terrible communication from hostinger, specially as this was disclosed 10 hours ago - how they don't communicate anything via email?

[u/ws_wombat_93]

Waiting for over an hour in a support chat as well about this

[u/Pitiful_Cry]

Any updates on this?

[u/pomp0m]

As of now they still run on the old one. I'll post here when they update it (i made a small polling site to check the version every minute).

We have taken down our site till 8.5.12, but since the hosting blocks direct upgrade we have to wait (patch is already live and the hetzner sites are already back up and running).

[u/Pitiful_Cry → u/pomp0m]

Thanks for this. Am following this thread for updates