News · October 2026
In short: you don’t need to do anything. In late September 2026, the PHP team released security updates for all supported PHP versions. We have updated the PHP versions on our servers to the patched releases, so your website, web shop and email run on secure software. In this article you can read which flaws were involved, what we did and what you can still check yourself.
What happened?
PHP is the programming language that powers WordPress, WooCommerce and most other websites. On 24 September 2026, PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 were released. All four are security releases, and the PHP team advises everyone to upgrade as soon as possible.
The most important fixes:
| Flaw | Component | What could happen? |
|---|---|---|
| CVE-2026-91765 | SOAP extension (severity: high, CVSS 7.5) | An attacker could crash a publicly reachable SOAP endpoint without logging in, using a specially crafted XML message. |
| CVE-2026-91768 | PHP-FPM | The access control (listen.allowed_clients) could be bypassed over IPv6 connections. |
| CVE-2026-91766 | HTTP streams | On a redirect to another server, credentials such as Authorization and Cookie headers could be sent along. |
| CVE-2026-91769 | OpenSSL streams | Server certificate verification could wrongly fall back to the Common Name. |
The releases also fix memory errors in, among others, the Phar extension and mysqlnd.
Earlier this year, on 30 July 2026, another security round was released (PHP 8.5.9, 8.4.24, 8.3.33 and 8.2.33). It fixed, among other things, an SQL injection in the PostgreSQL extension (CVE-2026-17543) and a memory error in bccomp() (CVE-2026-17544). Those updates have also been applied on our servers.
What did we do?
- All supported PHP versions on our servers have been updated to the patched releases. The updates are active on all our servers.
- Our standard security layers remain active, such as the Imunify360 firewall and malware scanner and our DDoS protection.
- We monitor new security advisories and install updates as soon as they are released.
What does this mean for your website?
Does your website use a supported PHP version (8.2 or newer)? Then it already runs on the secure version. You don’t need to change any settings or upload anything again.
Watch out for old PHP versions. PHP 7.4, 8.0 and 8.1 no longer receive security updates from the PHP team. If your website still runs on one of them, switch to a newer version. Support for PHP 8.2 also ends on 31 December 2026, so we recommend choosing PHP 8.3 or 8.4 now.
What can you do yourself?
- Check your PHP version. Log in to Plesk, go to Websites & Domains and click PHP (or PHP Settings) for your domain. There you can see which version is selected.
- Choose a current version. Does it say 7.4, 8.0, 8.1 or 8.2? Make a backup first, then select PHP 8.3 or 8.4 and click OK. Afterwards, check that your website works properly.
- Update WordPress, themes and plugins. A secure PHP version helps most when the software on top of it is up to date as well.
- Do you build with SOAP or external API integrations? Then check that your code doesn’t send credentials to other servers and that certificates are verified strictly.
You’ll find more step-by-step guides in our articles about Plesk, WordPress and security.
Need help?
Not sure which PHP version your website uses, or would you like us to take a look? Contact us via WhatsApp, ticket or email. Our support is truly available 24/7, also at night.
Not a customer yet? Our web hosting and WordPress hosting always run on current, secure software. Switching is free: we migrate your website and email without downtime.