The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help customers understand what they mean, who may be affected, and what sensible steps to take. This week we’re covering four issues: a supply-chain backdoor found in a popular WordPress video embedding plugin, a SQL injection flaw in Plesk’s XML-RPC API, a set of DNSSEC validation bypasses in BIND, and a synchronised security release across every supported PHP branch. The common thread this week is that three of the four issues affect software most website owners rely on without ever configuring directly, a plugin, a control panel API and a DNS resolver, which is exactly why regular patching and vendor monitoring matter even when nothing seems to have changed on your own site.
CRITICAL WordPress Plugin Supply-Chain Backdoor — Advanced Responsive Video Embedder (CVE-2026-18072)
A malicious version of the WordPress plugin Advanced Responsive Video Embedder, used to embed video from services such as Rumble, Odysee, YouTube, Vimeo and Kick, was published to the WordPress.org plugin repository on 28 July 2026. Version 10.8.7 contained a hidden function, disguised inside an update-check routine, that ran early in WordPress’s request handling and granted full administrator access to anyone who sent a single specially crafted HTTP request, without needing to log in at all. Wordfence’s automated threat intelligence system identified the malicious code within around two hours of it appearing and the WordPress.org team pulled the release the same day, so most sites did not receive it through automatic updates. The plugin has roughly 20,000 active installations.
Fixed version:
The malicious release has been removed from the WordPress.org repository; there is no separate patched 10.8.7 to update to, so sites should roll back to an earlier known-good version or wait for a fresh, verified release.
What this means for you:
If your site is on shared hosting and you did not update this plugin between 28 and 29 July, you were very likely never exposed, since the malicious version was withdrawn quickly and had limited distribution. If you run a VPS or dedicated server and manage plugin updates yourself, or have auto-updates enabled for this plugin, it is worth checking directly rather than assuming you were unaffected, since the exposure window was short but real.
Recommended action:
Check the installed version of Advanced Responsive Video Embedder on any WordPress site you manage. If it shows version 10.8.7, treat the site as potentially compromised: remove the plugin, audit administrator accounts for anything unfamiliar, invalidate active sessions, rotate WordPress secret keys and any stored credentials, and check outbound connections for traffic to the domain fontswp.com.
HIGH Plesk XML-RPC API Blind SQL Injection (CVE-2026-58046)
Plesk disclosed a SQL injection vulnerability in its XML-RPC API on 27–28 July 2026. The flaw lets a user who already has an authenticated customer or reseller-level account send crafted API requests that are not properly filtered before being used in a database query, allowing them to read data from the Plesk database that they should not have access to, including other users’ administrator credentials.
What this means for you:
On shared hosting, this matters most where multiple customer or reseller accounts share the same Plesk installation, since any one of those accounts could potentially read data belonging to others if the server is unpatched. On a VPS or dedicated server where you are the only Plesk user, the practical risk is lower, but you should still patch promptly since account compromise elsewhere could still be used as a stepping stone.
Recommended action:
Apply the Plesk update to 18.0.79.4 or later via Tools & Settings > Updates and Upgrades. If you cannot update immediately, restrict or disable access to the Plesk XML-RPC API until you can.
HIGH BIND 9 DNSSEC Validation Bypass and RPZ Wildcard Bypass (CVE-2026-13321, CVE-2026-10723, CVE-2026-11331)
ISC, the maintainers of the BIND DNS server, released BIND 9.20.26 and 9.21.24 on 22 July 2026, fixing nine vulnerabilities in total. Three of these stand out: two separate flaws in how BIND validates NSEC and NSEC3 records allow an attacker positioned to intercept or manipulate DNS traffic to bypass DNSSEC cryptographic validation under specific wildcard-record conditions, and a third flaw allows a wildcard CNAME response to slip past Response Policy Zone filtering, which many hosting providers and network operators use to block known-malicious domains at the resolver level. None of the nine issues are known to have been exploited in the wild, and ISC has said the recent run of BIND advisories reflects a big increase in vulnerability reports it is receiving, partly from LLM-assisted code review turning up latent bugs that have existed in the codebase for years.
What this means for you:
If you run your own recursive resolver or authoritative BIND server, whether on shared infrastructure or a dedicated box, these bypasses reduce the protection DNSSEC and RPZ filtering are meant to provide, though they require an attacker who can already intercept or inject DNS responses. If your DNS is handled entirely by your hosting provider’s managed resolvers, this is something for us to patch on our side rather than something you need to act on directly.
Recommended action:
Upgrade BIND to 9.20.26 (or 9.21.24 on the development branch) on any server where you run your own DNS resolution. If you are still on BIND 9.18, plan a migration to a supported branch, since no further security backports will be provided.
MEDIUM PHP Synchronised Security Release — pgsql SQL Injection and bcmath Memory Corruption (CVE-2026-17543, CVE-2026-17544)
The PHP project released updates across all four of its actively maintained branches on 28–29 July 2026: PHP 8.2.33, 8.3.33, 8.4.24 and 8.5.9. The release fixes two issues: a SQL injection vulnerability in the pgsql and PDO_PGSQL extensions, where a crafted string using PostgreSQL’s E’…’ backslash-escape syntax can break out of an intended query boundary, and a stack-based out-of-bounds memory write in the bcmath extension’s bccomp() function, triggered by crafted scale values. Both require an application to pass attacker-influenced input into the affected functions, so real-world impact depends on how a given website’s code uses these extensions.
What this means for you:
Whether you’re on shared hosting or a VPS, if your site or application uses PostgreSQL through PHP, or performs arbitrary-precision maths via bcmath with values that come from user input, you should prioritise this update. Sites that don’t use PostgreSQL or bcmath directly are at lower practical risk but should still update as part of routine PHP maintenance, since these extensions are often loaded by default even when unused.
Recommended action:
Upgrade PHP to the latest patch release for your branch (8.2.33, 8.3.33, 8.4.24 or 8.5.9) at your next maintenance window.
How to Check If Your Site Has Been Compromised
This week’s WordPress plugin backdoor is the item most likely to leave visible traces, so if you ran Advanced Responsive Video Embedder and are unsure whether you received the malicious 10.8.7 release, it’s worth checking for the following:
- Unfamiliar WordPress administrator accounts
- Active sessions you don’t recognise in your WordPress login activity
- Unexpected outbound connections to the domain fontswp.com in your server or firewall logs
- A file named fn-update-check.php inside the plugin’s folder that doesn’t match the legitimate plugin’s known files
If you find any of these signs, change your WordPress admin passwords and secret keys, remove the plugin, and review your site for any additional unfamiliar plugins, themes or scheduled tasks that may have been added afterwards.
Frequently Asked Questions
Do I need to do anything if I don't recognise any of these products by name?
If you don’t run Plesk, don’t manage your own BIND DNS server, and haven’t installed the Advanced Responsive Video Embedder plugin, three of this week’s four issues don’t apply to you directly. The PHP update is the one most website owners should still care about, since PHP underpins the majority of hosted websites.
Were any of these actively exploited before they were patched?
No. The BIND and PHP issues were disclosed and patched without evidence of prior exploitation. The Plesk issue was reported and fixed through Plesk’s standard disclosure process. The WordPress plugin backdoor is the exception: it was a genuine live compromise of the plugin’s release channel, though it was caught and withdrawn quickly.
I use a hosting provider that manages my server for me. Do I need to patch anything myself?
If your hosting provider manages your operating system, control panel and DNS, most of the underlying patching for BIND and Plesk should happen on our side. Plugin and application-level items, like the WordPress plugin here, remain your responsibility since you control what’s installed on your site.
How can I tell which PHP version my site is running?
Most control panels (Plesk, cPanel/WHM) show your current PHP version in their PHP settings or “Select PHP Version” tools. You can also create a small PHP file containing phpinfo(); and view it in a browser, though this should be removed again afterwards since phpinfo() output can reveal server details.
What should I do if I'm not sure whether I'm affected by any of this week's issues?
Check the plugin, control panel and PHP versions in use on your site against the “Affected” and “Fixed version” details above. If you’re still unsure, our support team can help you check your specific setup.
