{"id":26828,"date":"2026-07-31T10:38:21","date_gmt":"2026-07-31T09:38:21","guid":{"rendered":"https:\/\/www.heartinternet.uk\/blog\/?p=26828"},"modified":"2026-07-31T13:27:30","modified_gmt":"2026-07-31T12:27:30","slug":"weekly-cybersecurity-summary-24-july-to-30-july-2026","status":"publish","type":"post","link":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-24-july-to-30-july-2026\/","title":{"rendered":"Weekly Cybersecurity Summary \u2014 24 July to 30 July 2026"},"content":{"rendered":"[vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”3%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_column_text css=”” text_direction=”default”]The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help customers understand what they mean, who may be affected, and what sensible steps to take. This week we’re covering four issues: a supply-chain backdoor found in a popular WordPress video embedding plugin, a SQL injection flaw in Plesk’s XML-RPC API, a set of DNSSEC validation bypasses in BIND, and a synchronised security release across every supported PHP branch. The common thread this week is that three of the four issues affect software most website owners rely on without ever configuring directly, a plugin, a control panel API and a DNS resolver, which is exactly why regular patching and vendor monitoring matter even when nothing seems to have changed on your own site.[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”full_width_background” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” bg_color=”#ffffff” scene_position=”center” bottom_padding=”3%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” shape_type=”straight_section” gradient_type=”default”][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”right” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ text_color=”#000000″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”CRITICAL WordPress Plugin Supply-Chain Backdoor \u2014 Advanced Responsive Video Embedder (CVE-2026-18072)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”1″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]A malicious version of the WordPress plugin Advanced Responsive Video Embedder, used to embed video from services such as Rumble, Odysee, YouTube, Vimeo and Kick, was published to the WordPress.org plugin repository on 28 July 2026. Version 10.8.7 contained a hidden function, disguised inside an update-check routine, that ran early in WordPress’s request handling and granted full administrator access to anyone who sent a single specially crafted HTTP request, without needing to log in at all. Wordfence’s automated threat intelligence system identified the malicious code within around two hours of it appearing and the WordPress.org team pulled the release the same day, so most sites did not receive it through automatic updates. The plugin has roughly 20,000 active installations.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h4″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Fixed version:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]The malicious release has been removed from the WordPress.org repository; there is no separate patched 10.8.7 to update to, so sites should roll back to an earlier known-good version or wait for a fresh, verified release.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” top_padding=”3%” bottom_padding=”3%” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all” css=”.vc_custom_1785486111507{margin-bottom: 2% !important;}”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/6″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” min_height=”120″ icon_fontawesome=”fa fa-crosshairs” icon_size=”20″ link_url=”#”]\n
Affected<\/h5>\n

Advanced Responsive Video Embedder plugin, version 10.8.7 only[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” min_height=”120″ icon_size=”20″ link_url=”#” icon_fontawesome=”fa fa-star-half-o”]\n

CVSS:<\/h5>\n

9.8 (Critical)[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/6″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h4″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What this means for you:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]If your site is on shared hosting and you did not update this plugin between 28 and 29 July, you were very likely never exposed, since the malicious version was withdrawn quickly and had limited distribution. If you run a VPS or dedicated server and manage plugin updates yourself, or have auto-updates enabled for this plugin, it is worth checking directly rather than assuming you were unaffected, since the exposure window was short but real.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” top_padding=”0″ constrain_group_1=”yes” bottom_padding=”0″ text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h4″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Check the installed version of Advanced Responsive Video Embedder on any WordPress site you manage. If it shows version 10.8.7, treat the site as potentially compromised: remove the plugin, audit administrator accounts for anything unfamiliar, invalidate active sessions, rotate WordPress secret keys and any stored credentials, and check outbound connections for traffic to the domain fontswp.com.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”full_width_background” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” bg_color=”#ffffff” scene_position=”center” bottom_padding=”3%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” shape_type=”straight_section” gradient_type=”default”][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”right” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”HIGH Plesk XML-RPC API Blind SQL Injection (CVE-2026-58046)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”1″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]Plesk disclosed a SQL injection vulnerability in its XML-RPC API on 27\u201328 July 2026. The flaw lets a user who already has an authenticated customer or reseller-level account send crafted API requests that are not properly filtered before being used in a database query, allowing them to read data from the Plesk database that they should not have access to, including other users’ administrator credentials.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” top_padding=”3%” bottom_padding=”3%” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all” css=”.vc_custom_1785486111507{margin-bottom: 2% !important;}”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” min_height=”120″ icon_fontawesome=”fa fa-crosshairs” icon_size=”20″ link_url=”#”]\n

Affected<\/h5>\n

Plesk versions prior to 18.0.79.4[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” min_height=”120″ icon_fontawesome=”fa fa-thumb-tack” icon_size=”20″ link_url=”#”]\n

Fixed version:<\/h5>\n

18.0.79.4[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” min_height=”120″ icon_size=”20″ link_url=”#” icon_fontawesome=”fa fa-star-half-o”]\n

CVSS:<\/h5>\n

Not yet published by Plesk; classified as a blind SQL injection requiring an authenticated low-privilege account[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h4″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What this means for you:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]On shared hosting, this matters most where multiple customer or reseller accounts share the same Plesk installation, since any one of those accounts could potentially read data belonging to others if the server is unpatched. On a VPS or dedicated server where you are the only Plesk user, the practical risk is lower, but you should still patch promptly since account compromise elsewhere could still be used as a stepping stone.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h4″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Apply the Plesk update to 18.0.79.4 or later via Tools & Settings > Updates and Upgrades. If you cannot update immediately, restrict or disable access to the Plesk XML-RPC API until you can.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”3%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all” css=”.vc_custom_1785427509550{padding-bottom: 3% !important;}”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”HIGH BIND 9 DNSSEC Validation Bypass and RPZ Wildcard Bypass (CVE-2026-13321, CVE-2026-10723, CVE-2026-11331)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”1″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]ISC, the maintainers of the BIND DNS server, released BIND 9.20.26 and 9.21.24 on 22 July 2026, fixing nine vulnerabilities in total. Three of these stand out: two separate flaws in how BIND validates NSEC and NSEC3 records allow an attacker positioned to intercept or manipulate DNS traffic to bypass DNSSEC cryptographic validation under specific wildcard-record conditions, and a third flaw allows a wildcard CNAME response to slip past Response Policy Zone filtering, which many hosting providers and network operators use to block known-malicious domains at the resolver level. None of the nine issues are known to have been exploited in the wild, and ISC has said the recent run of BIND advisories reflects a big increase in vulnerability reports it is receiving, partly from LLM-assisted code review turning up latent bugs that have existed in the codebase for years.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” top_padding=”3%” bottom_padding=”3%” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all” css=”.vc_custom_1785486111507{margin-bottom: 2% !important;}”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” min_height=”120″ icon_fontawesome=”fa fa-crosshairs” icon_size=”20″ link_url=”#”]\n

Affected<\/h5>\n

BIND 9 versions prior to 9.20.26 (stable) and 9.21.24 (development); BIND 9.18 is now end of life with no backported fixes[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” min_height=”120″ icon_fontawesome=”fa fa-thumb-tack” icon_size=”20″ link_url=”#”]\n

Fixed version:<\/h5>\n

9.20.26 \/ 9.21.24[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” min_height=”120″ icon_size=”20″ link_url=”#” icon_fontawesome=”fa fa-star-half-o”]\n

CVSS:<\/h5>\n

CVE-2026-13321: 8.6 (High). CVE-2026-10723: 6.8 (Medium). CVE-2026-11331: 7.5 (High).[\/fancy_box][\/vc_column_inner][\/vc_row_inner][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”default” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What this means for you:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]If you run your own recursive resolver or authoritative BIND server, whether on shared infrastructure or a dedicated box, these bypasses reduce the protection DNSSEC and RPZ filtering are meant to provide, though they require an attacker who can already intercept or inject DNS responses. If your DNS is handled entirely by your hosting provider’s managed resolvers, this is something for us to patch on our side rather than something you need to act on directly.[\/vc_column_text][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Upgrade BIND to 9.20.26 (or 9.21.24 on the development branch) on any server where you run your own DNS resolution. If you are still on BIND 9.18, plan a migration to a supported branch, since no further security backports will be provided.[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”3%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”MEDIUM PHP Synchronised Security Release \u2014 pgsql SQL Injection and bcmath Memory Corruption (CVE-2026-17543, CVE-2026-17544)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”1″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]The PHP project released updates across all four of its actively maintained branches on 28\u201329 July 2026: PHP 8.2.33, 8.3.33, 8.4.24 and 8.5.9. The release fixes two issues: a SQL injection vulnerability in the pgsql and PDO_PGSQL extensions, where a crafted string using PostgreSQL’s E’…’ backslash-escape syntax can break out of an intended query boundary, and a stack-based out-of-bounds memory write in the bcmath extension’s bccomp() function, triggered by crafted scale values. Both require an application to pass attacker-influenced input into the affected functions, so real-world impact depends on how a given website’s code uses these extensions.[\/vc_column_text][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” top_padding=”3%” bottom_padding=”3%” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all” css=”.vc_custom_1785486111507{margin-bottom: 2% !important;}”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” min_height=”120″ icon_fontawesome=”fa fa-crosshairs” icon_size=”20″ link_url=”#”]\n

Affected<\/h5>\n

PHP versions prior to 8.2.33, 8.3.33, 8.4.24 and 8.5.9[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” min_height=”120″ icon_fontawesome=”fa fa-thumb-tack” icon_size=”20″ link_url=”#”]\n

Fixed version:<\/h5>\n

8.2.33 \/ 8.3.33 \/ 8.4.24 \/ 8.5.9 (matching whichever branch you run)[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” min_height=”120″ icon_size=”20″ link_url=”#” icon_fontawesome=”fa fa-star-half-o”]\n

CVSS:<\/h5>\n

Not yet published by php.net at the time of writing[\/fancy_box][\/vc_column_inner][\/vc_row_inner][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What this means for you:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Whether you’re on shared hosting or a VPS, if your site or application uses PostgreSQL through PHP, or performs arbitrary-precision maths via bcmath with values that come from user input, you should prioritise this update. Sites that don’t use PostgreSQL or bcmath directly are at lower practical risk but should still update as part of routine PHP maintenance, since these extensions are often loaded by default even when unused.[\/vc_column_text][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”default” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Upgrade PHP to the latest patch release for your branch (8.2.33, 8.3.33, 8.4.24 or 8.5.9) at your next maintenance window.[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”3%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”How to Check If Your Site Has Been Compromised” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”1″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]This week’s WordPress plugin backdoor is the item most likely to leave visible traces, so if you ran Advanced Responsive Video Embedder and are unsure whether you received the malicious 10.8.7 release, it’s worth checking for the following:[\/vc_column_text][vc_column_text css=”” text_direction=”default”]\n