{"article":{"id":44397729587351,"url":"https://plesk-new.zendesk.com/api/v2/help_center/en-us/articles/44397729587351.json","html_url":"https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk","author_id":1509297110681,"comments_disabled":false,"draft":false,"promoted":true,"position":0,"vote_sum":21,"vote_count":55,"upvote_count":38,"downvote_count":17,"section_id":43383903365655,"created_at":"2026-10-20T21:05:36Z","updated_at":"2026-10-22T05:29:18Z","name":"Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk","title":"Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-10-22T02:11:20Z","user_segment_id":null,"permission_group_id":13590741941911,"content_tag_ids":[],"label_names":["kb: security","kb: ai-created"],"body":"

Situation

Two security vulnerabilities were discovered in PHP. As a result, all PHP versions shipped with Plesk are also affected. These security vulnerabilities have been identified as CVE-2026-109618 and CVE-2026-109619.

Affected product version

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ProductAffected versionsPatched versions
PHP 8.58.5.11 and below8.5.12
PHP 8.48.4.26 and below8.4.27
PHP 8.38.3.35 and below8.3.36
PHP 8.28.2.34 and below8.2.35
PHP 8.1 (EOL)8.1.34 (built before 21 Oct 2026)8.1.34 (built on 21 Oct 2026)
PHP 8.0 (EOL)8.0.30 (built before 21 Oct 2026)8.0.30 (built on 21 Oct 2026)
PHP 7.4 (EOL)7.4.33 (built before 21 Oct 2026)7.4.33 (built on 21 Oct 2026)
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ProductAffected versionsPatched versions
PHP 8.58.5.11 and below8.5.12
PHP 8.48.4.26 and below8.4.27
PHP 8.38.3.35 and below8.3.36
PHP 8.28.2.34 and below8.2.35
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ProductAffected versionsPatched versions
Plesk for Linux (sw-engine, part of Plesk UI)
    \n
  • Plesk Obsidian 18.0.80 Update 10 and below
    • \n
  • Plesk Obsidian 18.0.81 through 18.0.81 Update 3
    • \n
    \n
  • Plesk Obsidian 18.0.80 Update 11
    • \n
  • Plesk Obsidian 18.0.81 Update 4
    • \n
Plesk for Windows (sw-engine, part of Plesk UI)
    \n
  • Plesk Obsidian 18.0.80 Update 10 and below
    • \n
  • Plesk Obsidian 18.0.81 through 18.0.81 Update 3
    • \n
    \n
  • Plesk Obsidian 18.0.80 Update 11
    • \n
  • Plesk Obsidian 18.0.81 Update 4
    • \n

Note: for older versions of PHP (5.6, 7.2, 7.3) it is recommended to use paid TuxCare Extended Lifecycle Support for PHP.

Impact

Both vulnerabilities are rated critical (CVSS scores of 9.2). Remote code execution (RCE) is possible on affected PHP versions.

Call to action

Update Plesk to the latest available version.

A fix is available for most affected versions. The PHP vendor released the fixed PHP versions on 21 October 2026 at 14:00 UTC (PHP News Archive | 21 Oct 2026). 

Fixes for Plesk for Linux are already available for PHP 8.2 (as 8.2.35), 8.3 (as 8.3.36), 8.4 (as 8.4.27) and 8.5 (as 8.5.12). 
Fixes for EOL PHP versions on Plesk for Linux 7.4.33, 8.0.30, 8.1.34 have the same version number, but different build date. Versions built on 21 October 2026 have fixes included.

Fixes for Plesk for Windows are available for PHP 8.2 (as 8.2.35), 8.3 (as 8.3.36), 8.4 (as 8.4.27) and 8.5 (as 8.5.12)

Fixes for sw-engine (PHP engine used by Plesk itself) are already available in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11 for both Plesk for Linux and Plesk for Windows. Check the Plesk version installed on the server.

How to check PHP version on Plesk server:

\n
In Plesk UI:
\n
\n
    \n
  1. Log into Plesk
    2. \n
  2. Navigate to Tools & Settings > PHP Settings menu. Versions should be reflected in handler names:
    3. \n
\n

\"Plesk-php-handlers.png\"

\n
\n
\n
In CLI (Linux):
\n
    \n
  1. Connect to the server via SSH\n
    2. \n
  2. \n

    Execute the command below for corresponding PHP version (8.3 is used in this example):

    \n

    # /opt/plesk/php/8.3/bin/php -v
    PHP 8.3.36 (cli) (built: Oct 21 2026 08:04:57) (NTS)
    Copyright (c) The PHP Group
    Zend Engine v4.3.36, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.36, Copyright (c), by Zend Technologies

    \n
    3. \n
\n
","user_segment_ids":[]}}