If I can't patch it the same day, I don't host it myself

Arthur Rahimov — Thu, 22 Oct 2026 22:59:11 +0000

Two critical PHP bugs came out this week. Both can let an attacker run code on a server. No login needed.

Today I got an email from Hetzner. The message was simple: you run your own server, so the update is your job.

So I checked my own setup.

My sites run WordPress on managed hosting. The host patched PHP for me. I only checked the build date.

My Hetzner server has no PHP on it. Nothing to patch this time.

The funny part: a few days earlier I was thinking about moving my WordPress sites to that server. It would save some money.

This week showed me the real cost. On my own server, the patch is my job. The same day. Maybe at night.

And that server runs my automation. A hacked WordPress next to it is a risk for everything else.

So the sites stay on managed hosting for now. The server stays for agents only.

My simple rule: if I can't patch it the same day, I don't host it myself.

Who patches PHP on your sites? Do you know for sure?

Sources