On 21 October 2026, Matomo published a security advisory about two critical PHP vulnerabilities. According to Matomo, its Cloud customers are already protected and need to take no action, while On-Premise and self-hosted users should review the recommended PHP security updates.
That is not a criticism of Matomo. It is simply how self-hosting works. If you run the software, you also run everything underneath it. This guide lists what that involves, so you can decide with the full picture.
What “self-hosted” includes
Installing the analytics software is the first hour. The list that follows never ends:
- The language runtime. Most self-hosted analytics tools run on PHP. When PHP has a security release, you update it, then check that the tool still works on the new version.
- The operating system and web server. Kernel, web server and database updates all arrive on their own schedule.
- The analytics software itself. New releases, plugin updates, and occasional breaking changes.
- The database. Tracking data grows every day. Disk space, slow queries and archiving jobs need someone watching them.
- Backups. A backup that has never been restored is a guess. Someone has to set it up and test it.
- Monitoring. If tracking stops on a Friday night, you want to hear about it before Monday’s report is empty.
What it looks like on a day like 21 October
A vulnerability is announced. If you self-host, the day goes roughly like this: read the advisory, find out which of your servers run the affected version, schedule the update, apply it, test that tracking and reports still work, and write down that you did it. If the person who normally does this is on holiday, the site waits.
None of this is hard for an experienced admin. The cost is that it is unplanned, and it is yours.
When self-hosting is the right choice
Be honest about this part. Self-hosting makes sense when:
- you have a rule that data must stay on servers you control,
- you already have a team that patches and monitors servers anyway,
- you want to change the software itself.
If that describes you, keep your setup and put patch dates in the calendar.
When hosted is the better fit
Hosted analytics makes sense when nobody on your side wants to be the person who patches the analytics server. With a hosted service, the provider does the updates, and your work is limited to installing a tracking snippet and reading reports.
That is how Hitsteps works. We run the servers. When PHP released fixes on 21 October, we deployed the fixes to our affected services on the same day. We wrote that up in our security update.
A quick checklist before you decide
- Who patches the server when a critical advisory lands? Name a person and a backup.
- How fast could you apply an update, including testing?
- When did you last restore a backup?
- How many hours a month does upkeep take, and what else could they be spent on?
If the honest answers are “nobody”, “unsure”, “never” and “more than I thought”, hosted analytics will probably save you time.
Next step
If you use Matomo On-Premise today and want to compare, our Hitsteps vs Matomo page shows the differences side by side. Hitsteps has a Free plan for one site, and every new account starts with a 7-day Pro trial without a credit card, so you can run it next to your current setup before you change anything.
