What Hostinger said on October 21
On its status page, Hostinger opened an incident titled « PHP Security Update Across Managed Hosting Plans » at 7:44 PM, Paris time: their teams tested the PHP2Shell vulnerability on their servers, stated that it does not allow taking control of hosted sites, including WordPress, added a protective layer, and deployed the patched PHP versions anyway. The displayed conclusion was: « no client-side action required ». By 9:12 PM, the deployment was complete for the Agency plan and ongoing on other servers. The same message was posted on their X account.
This is the clearest communication of the day among hosting providers. Two caveats remain, however. Hostinger runs on LiteSpeed, and the announced protection has not been detailed. Most importantly, ‘no action required’ applies only to the PHP branches that are still being patched: if your site is on 8.1 or an older version, there is no patched version available to install, and only a version change truly protects you.
Where to check the PHP version in hPanel
In hPanel, open Websites, click on Manage next to the site, then in the sidebar, under Advanced, select PHP Configuration. The current version is displayed at the top of the page. The tabs PHP Extensions and PHP Options on the same page allow you to enable extensions and set memory or upload limits.
The detail that matters at Hostinger: the version chosen here applies to all sites on the hosting plan, except for sites created with their AI Builder. If you have a portfolio site and a store on the same plan and want different versions, it’s the `.htaccess` file in the relevant folder that decides, with a line like `SetHandler application/x-lsphp83`, the number changing depending on the desired version. Hostinger documents this method in its help center.
Changing the version
Still in PHP Configuration, select the desired version and click on Update. Hostinger states that the new version is applied « in a few minutes ». After the change, go back to the PHP Extensions tab: the list of available extensions varies by version, and an extension your site needs may have been unchecked in the process. This is the first cause of a blank page right after a version change with them.
On older plans that still use cPanel, the path is through cPanel: section Software, tool Select PHP Version, choose the version, then Set as current.
Which version to choose
PHP 8.3 or 8.4: the right choice for WordPress, WooCommerce, or a newer tool. The patched versions are 8.3.36 and 8.4.27, with security fixes valid until 2027 and 2028. At Hostinger, 8.3 is the default version offered to new sites, and the menu ranges from 8.2 to 8.5.
PHP 8.2: patched up to 8.2.35, but the branch ends on December 31, 2026.
PHP 8.1 and older: Hostinger has removed these versions from the menu, but a site already set to one of them remains unchanged until someone modifies it. No official patched version exists for these branches. If your site is on one of them, upgrading is not just a matter of comfort—it’s a security update itself. Check beforehand that your theme and plugins support the target version: WordPress works from 7.4 to 8.5; it’s outdated plugins that break things.
Check that the patch is properly installed
The hPanel menu displays the branch, not the exact patch number. The full number appears on a phpinfo page or, on WordPress, in Tools, then Site Health, tab Info, section Server. The numbers to look for are 8.2.35, 8.3.36, 8.4.27, or 8.5.12. If you see a lower number, the deployment announced on October 21 hasn’t reached your server yet: Hostinger’s status page shows the progress, and the verification tool reads the number once the server displays it.
If the site breaks after the change
The reflex: go back to the previous version through the same menu, long enough to update the faulty extension or theme, then go back up. Before any action, make a backup outside the server, and ideally test it on a copy of the site. A blank page or a 500 error right after the change almost always comes from a PHP extension that was unchecked or a function removed between branches.
And if you don’t want to handle it yourself
I perform this intervention remotely: backup, testing on a copy, version change, extension verification, patch control, testing of the homepage, the admin panel, and a payment, followed by a written report. Write to me with the link to your site, I’ll reply within 24 hours. The same guides exist for OVHcloud, o2switch, IONOS, Infomaniak and PlanetHoster.
Sources: Hostinger help: « How to change the PHP version », Hostinger help: « PHP version per subfolder », Hostinger status page, October 21, 2026 incident, fixed versions on php.net.
