Website updates: who is responsible, the host or the contractor?

In October 2026, urgent fixes came out for PHP and Node.js, the software that a large share of business websites and online stores run on. Days like that always raise the same question: who was supposed to install them? The host, the company that built the website, or maybe you?

The answer depends on where the website runs and what the contract says. In this guide I break a website down into layers, show who is usually responsible for each of them on shared hosting, on a VPS and on a subscription platform, and give you ready-made questions for your host and your contractor. As of 30 October 2026. I’m not a lawyer, so the parts about contracts and GDPR are not legal advice.

October 2026: PHP2Shell and Node2Shell

On 21 October 2026 the PHP developers released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. They patch two critical vulnerabilities named PHP2Shell, which can allow remote code execution on the server without logging in. On the same day the Node.js project released versions 22.23.4, 24.22.1 and 26.12.1 with a fix for the Node2Shell vulnerability in the Brotli decoder.

For PHP 8.1 and older, the PHP developers did not release new versions. They only made source code patches available for 7.4, 8.0 and 8.1, which are used by people who compile PHP themselves. Node.js lines past end of support (e.g., 20.x) will not get the fix. Some hosting providers state that they patch older PHP versions on their own, so you need to ask your host about your version. I describe the details and how to check your website in the guides on the PHP2Shell vulnerability in PHP and the Node2Shell vulnerability in Node.js. Newer releases that also contain these fixes may come out later, so before making a decision check the current versions on php.net and in the Node.js announcement.

This story shows the division of duties well. On shared hosting, the PHP fix is installed by the host. But if the website runs on PHP 7.4 because nobody moved it to a newer version, there is no new release from the PHP developers: you have to ask the host for a patch, and moving the website is a job for the owner or the contractor.

What a website is made of: 4 layers to update

To work out who updates what, break the website down into layers:

1. System and server: the operating system, the web server, the database.
2. Runtime environment: PHP or Node.js in a specific version, e.g., 8.3 or 24.x.
3. Application: WordPress, PrestaShop, WooCommerce, plugins, the theme, or the website’s own code with libraries (e.g., Next.js).
4. Accounts and access: passwords, two-factor authentication, the list of people with an administrator account.

Each layer can have a different “owner”. Below is the typical division:

This is a typical division, not a guaranteed one. What is binding are your host’s terms of service and your contract with the contractor.

Shared hosting: the host patches the server, you choose the version

On regular hosting (a plan with a panel where you keep your website and email), the server belongs to the provider. The provider updates the system and installs new PHP releases. In its hosting documentation, OVHcloud writes that it installs the latest PHP versions on its servers, while the customer has to make sure their website is up to date and compatible with new versions (OVHcloud documentation).

The PHP version, that is, whether the website runs on 8.2, 8.3 or 8.4, you usually choose yourself in the panel. Hosts withdraw old versions or move them to paid add-ons. Two examples as of 30 October 2026:

• nazwa.pl: versions from 8.2 up are available at no extra cost, and older ones (from 5.3 to 8.1) only in a paid add-on service. Changing the version applies to the whole server, meaning all the websites on it, and nazwa.pl notes that going back to the previous version does not guarantee that the websites will work correctly (nazwa.pl help).
• AZ.pl: according to the terms of its service supporting older PHP versions (in force since 2 January 2026), simply keeping an unsupported version means ordering a paid service. AZ.pl is not responsible for the consequences of vulnerabilities in such versions, and when an old version threatens its infrastructure, it can force a change to a current one if an earlier request to do so has no effect.

The takeaway: the host looks after the machine, but it won’t move your website to a newer PHP version for you, and it won’t update WordPress or plugins. If you stay on an old version, you will pay for the add-on, and the risk stays with you. I show how to change the version safely in the guide on the end of PHP 8.2 support.

VPS: the whole server is yours, patches included

A VPS (virtual private server) gives you full control, but also full responsibility. OVHcloud states outright that, unlike with managed hosting, server maintenance, backups and protection against attacks are the customer’s job (introduction to VPS). The provider takes care of the hardware and the network, while the system, PHP, Node.js and everything running on them is updated by the owner or the person the owner has commissioned.

This is where a gap in duties easily appears. The contractor sets up the website on a VPS, hands over the project, and the contract says nothing about further updates. With Node2Shell, such a website would wait for a new version of Node.js until someone took it upon themselves to install it. If you have a VPS and don’t know who updates it, treat this as an urgent question for your contractor.

Subscription platforms: Shoper, Wix and similar

On a subscription platform you have no access to the server or the code, so the provider does the updates. Shoper writes in its materials that stores on a subscription get new software versions on an ongoing basis. Wix describes its own security team, which monitors the platform and responds to threats.

What stays on your side are the accounts. Turn on two-factor authentication, remove the accounts of former employees and contractors, and don’t share a single password. Also review third-party apps connected to your store: their authors are responsible for updating them, but the decision whether to use them is yours.

A custom-built website: the contract decides

When a contractor built the website for you, the host still patches the server (unless it’s a VPS), but the application belongs to “nobody” until the contract says otherwise. Building the website does not by itself include updating it later. That is a separate service, usually called technical maintenance.

Don’t count on WordPress updating itself, either. According to the WordPress documentation, by default minor core releases (with security fixes) and translations install automatically, and major releases do so only on sites installed since version 5.6. Plugins and themes update themselves only when someone turns this on, or in exceptional situations decided by the WordPress security team.

What to put in the development or maintenance contract (I write more about the contract itself in the guide on the website development contract):

• Scope of updates, named explicitly: CMS, plugins, theme, libraries in the code, PHP or Node.js version, and with a VPS also the system.
• Schedule and urgent mode: regular updates, for example once a month, and for a critical vulnerability a separate response time given in hours.
• Backup before, test after: a backup before each update and a check of the form, cart and payments after it.
• End of version support: who keeps track of the dates (PHP 8.2 loses support on 31 December 2026), who plans the move and how it is priced.
• What happens if an update breaks something: who fixes it, how quickly and whether it’s covered by the fee.
• Report: a list of installed updates, for example monthly.
• Access: the administrator account and the hosting account in your company’s name, with the contractor as an additional user. If today only the contractor has access, see how to regain access to your website from an agency.
• Personal data: if the contractor has access to customer data, a data processing agreement is required (Art. 28 GDPR).

Remember that handing updates over to someone else does not transfer responsibility for customer data. As the data controller, your company must ensure appropriate safeguards (Art. 32 GDPR), and the contractor and the host help you with this under their contracts. The AZ.pl terms say the same thing outright: the customer, as the data controller, is responsible for the consequences of vulnerabilities resulting from an unsupported PHP version.

How to check who updates your website

You don’t need a developer for this. A quarter of an hour is enough.

1. Find the invoices. What are you paying for: a hosting plan, a VPS (virtual private server), a platform subscription, maintenance? Each invoice is one layer and one recipient for your questions.
2. Log in to the hosting panel. If you see a choice of PHP version, you have shared hosting: write down the version number. If the provider shows a server with an operating system (e.g., Ubuntu or Debian) and administrator access, you have a VPS.
3. Check which email address receives notices from the host. Warnings about versions being withdrawn go there, not to the contractor who finished the project long ago.
4. Open the contract with the contractor and look for the words “updates”, “care”, “maintenance”. If they aren’t there, updates are nobody’s duty.
5. Send two questions, ready-made below.

To the host:

Hello, I have the website [domain] on the [plan name] plan. Please let me know: 1) whether the PHP fixes of 21 October 2026 (PHP2Shell) have been deployed for the PHP version set on my account, 2) which version it is and until when it will be available at no extra cost, 3) how far in advance and to which address you send notice of a version being withdrawn, 4) whether you make backups, how often and how long you keep them.

To the website contractor:

Hello, please confirm who is responsible for updating the website [domain]: the CMS, plugins, theme, libraries in the code and the PHP or Node.js version. Is this covered by our contract? If not, please send me an offer for maintenance with a response time for critical vulnerabilities and a monthly list of updates.

What to do today

• Write down in one place where the website runs, who has access and which email address receives notices.
• Check your PHP or Node.js version. If it has lost support, plan the move this year.
• Send the questions to your host and contractor, even if everything works.
• If nobody is responsible for updates, assign them: to yourself, to the contractor or to a technical maintenance company. And put it in the contract.

Summary

On shared hosting, the server and PHP fixes are on the host’s side, but the PHP version, the CMS and plugins belong to you or the contractor. On a VPS you are responsible for the whole server, and on a subscription platform for accounts and add-ons. Anything that isn’t in the contract is, in practice, nobody’s duty.

If you would rather put it all in one pair of hands, technical maintenance in my Watch plan costs from PLN 149 net a month: monitoring, an off-server backup every week, updates once a month, and urgent ones within 2 days. Standard (from PLN 349 net a month) gives you daily backups, updates twice a month and a response within 1 business day, and Pro (from PLN 749) a response within 4 hours, including when something fails on a weekend. I can also provide domain and hosting from PLN 390 net a year. Have a question about your website? Write to me, I reply within 24 hours.