Security update — 22 October 2026. Our latest checks confirmed the relevant PHP security fixes in the web runtimes reviewed for the Nakroteck customer portal, managed hosting and hosting control panels. We also updated the separate PHP runtime used by our managed WordPress control panel.
Follow-up remains open for a separate vendor-supplied internal scanning runtime and retained maintenance components. The scope and limits of this update are explained below.
Why we checked PHP
On 21 October 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. In affected environments, these flaws can allow an attacker to run code on a server without signing in. PHP is used by WordPress and many other website applications. The PHP project recommends installing the relevant security updates.
What Nakroteck verified
We checked installed package builds and the executable files used by running PHP processes. The review covered our customer portal and the four hosting servers registered in our hosting management system, including the separate control-panel runtimes.
- Customer portal: the running PHP runtime is on PHP 8.4.27.
- Plesk hosting: the reviewed PHP 8.2–8.5 runtimes have the fixed upstream releases. Installed legacy PHP 7.4, 8.0 and 8.1 builds match Plesk's security backports released on 21 October. The reviewed Plesk control-panel engines are also patched.
- Managed WordPress hosting: the reviewed website PHP runtimes were already patched. We updated the separate Hestia control-panel runtime from PHP 8.5.9 to 8.5.12 and confirmed the running panel process uses the new build.
The control-panel update preserved its existing PHP configuration and module list. Follow-up checks confirmed that the panel login page and the website checked on that server were responding. Firewall and hosting protection services remained active.
What remains under review
Two servers also contain a separate PHP runtime supplied with internal security-scanning software. We have not verified a vendor fix for that component. Its PHP web-serving service was inactive and disabled in our checks; the running instance observed on one server was a command-line scanner. We are keeping this as an open vendor follow-up rather than claiming every installed PHP component is patched.
The Plesk servers also retain older command-line maintenance engines from previous updates. These were not observed serving web requests and are outside the verified web-runtime coverage. The current Plesk panel and latest maintenance engine have the PHP security fixes; the retained engines require a separate vendor-supported maintenance review.
This review covers the servers described above. Customer-managed VPS servers, external providers and other independently managed systems require their own checks. Patch verification also does not establish whether a system was exploited before an update was installed.
What customers should do
If you use Nakroteck managed hosting: these server-runtime updates do not require you to change DNS, move email or install PHP yourself. Continue keeping your website application, themes and plugins current. A WordPress update alone does not fix a vulnerability in the server's PHP runtime.
If you manage your own VPS or dedicated server: check your operating-system or PHP vendor's security packages, apply the relevant fixes and ensure running PHP workers use the updated build. An older-looking version number can contain a vendor backport, so check the complete package revision and vendor advisory.
If your website shows an unexpected error or unusual behaviour, contact Nakroteck support with the exact URL, the time it happened and a screenshot. Do not include passwords in your message.
Further information
Need help choosing the right setup?
Talk to Nakroteck before you buy hosting, domains, SSL, or website services. We will help you choose the right option for your business.