On 21 October 2026, two critical security vulnerabilities in PHP were made public: CVE-2026-109618 and CVE-2026-109619. PHP runs WordPress, Joomla and most other content management systems, and these flaws could let an attacker run their own code on an unpatched server.
What we’ve done
We updated PHP on our Plesk hosting servers on 22 October 2026. These are the patched versions now available:
| PHP version | Updated to |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
As an extra precaution, we moved accounts that were still on an older PHP version up to at least PHP 8.2.35.
Do you need to do anything?
Most customers don’t. The exception is a site built on old code: an outdated theme, plugin or custom application may not work on a newer PHP version.
Take a few minutes to check your site, especially contact forms, shopping carts, booking systems and anything else visitors fill in or click through. If something has broken, your website developer or IT provider is the right person to fix the site itself. For help with your hosting or the server, open a support ticket in the client portal at my.istartcloud.com.
Keep your own software up to date
We look after the servers. Your website’s software is yours to keep current: WordPress, Joomla or any other CMS, with its plugins, themes and custom code. An outdated plugin can still be broken into on a fully patched server.
On our Plesk hosting, WordPress Toolkit lets you update WordPress, themes and plugins from one screen. See how WordPress Toolkit works.