On PulseHeberg web hosting, we rely on TuxCare ELS to maintain all the PHP versions we offer. This service allows us to provide security patches across a wide range of versions, including when their support by the PHP project has ended.

We rely on TuxCare ELS precisely to receive security fixes quickly: PHP vulnerabilities are addressed through patches, including backported fixes, which we deploy automatically on our hosting. Your displayed PHP version can therefore remain unchanged while continuing to receive security updates.

How are security updates applied?#

PHP updates provided by TuxCare ELS are installed and deployed automatically on our hosting. You do not need to take any action in Plesk or contact support to receive these patches.

This automatic deployment can take place several times a day, depending on the available patches. Your hosting therefore receives regular security updates while preserving compatibility with your sites as much as possible.

These updates may take the form of new package revisions: the software receives a patch without necessarily changing the visible PHP version number. These are not necessarily new functional versions of PHP.

What is a backported patch?#

Backporting consists of adapting a security patch to an earlier version of the software, without requiring a migration to the latest PHP version.

For example, a package showing PHP 8.5.11 may contain the fixes for a flaw corrected in the official PHP 8.5.12 version. The number then remains 8.5.11, but the code affected by the flaw has been fixed in the package revision provided by TuxCare.

The CloudLinux documentation on PHP updates from October 2026 confirms that patched packages keep numbers lower than those of the official PHP project versions.

Example: the October 2026 vulnerabilities#

After a prior announcement on 20 October, the PHP project published on 21 October 2026 patches for CVE-2026-109618 and CVE-2026-109619, notably in PHP 8.5.12. These two vulnerabilities and the official fixed versions are described by the PHP Foundation.

For these two CVEs, TuxCare and CloudLinux provided packages with backported fixes while retaining version numbers lower than those of the new official releases. This is the patching mechanism we use, with automatic deployment on our hosting. Fixes are tracked through the package revision and its security history, rather than just the displayed PHP version number.

Why might an audit tool report an old version?#

Some tools only compare the detected version number with a list of vulnerable versions. They may then report an alert without taking backported patches into account.

If your audit reports a PHP vulnerability, send our support team:

  • The domain concerned.
  • The detected PHP version number.
  • The vulnerability identifier, for example a CVE reference.
  • The tool's report and the date of the check.

Our team can confirm the patches applied and provide the details you need for your audit. You do not need to request their installation: TuxCare ELS updates are deployed automatically.

Is an end-of-life version still maintained?#

The end of official support by the PHP project and the end of maintenance by PulseHeberg are two distinct things. TuxCare ELS allows security updates for covered versions to be extended beyond their official end of life.

This maintenance gives you time to adapt your site. It is still advisable to prepare the move to a recent version compatible with your application. PHP updates do not replace those of your CMS, its extensions or your own code.

To find out which versions are offered, see the available PHP versions. To change a site's version, follow the procedure for selecting the PHP version in Plesk.