$hash = password_hash($plain, PASSWORD_DEFAULT);

if (password_verify($submitted, $hash)) {
    if (password_needs_rehash($hash, PASSWORD_DEFAULT)) {
        $hash = password_hash($submitted, PASSWORD_DEFAULT);
    }
}