Situation
Two security vulnerabilities were discovered in PHP. As a result, all PHP versions shipped with Plesk are also affected. These security vulnerabilities have been identified as CVE-2026-109618 and CVE-2026-109619.
Affected product version
- PHP on Plesk Obsidian for Linux:
| Product | Affected versions | Patched versions |
|---|---|---|
| PHP 8.5 | 8.5.11 and below | 8.5.12 |
| PHP 8.4 | 8.4.26 and below | 8.4.27 |
| PHP 8.3 | 8.3.35 and below | 8.3.36 |
| PHP 8.2 | 8.2.34 and below | 8.2.35 |
| PHP 8.1 (EOL) | All versions | In development |
| PHP 8.0 (EOL) | All versions | In development |
| PHP 7.4 (EOL) | All versions | In development |
- PHP on Plesk Obsidian for Windows:
| Product | Affected versions | Patched versions |
|---|---|---|
| PHP 8.5 | 8.5.11 and below | In development |
| PHP 8.4 | 8.4.26 and below | In development |
| PHP 8.3 | 8.3.35 and below | In development |
| PHP 8.2 | 8.2.34 and below | In development |
- Plesk Obsidian (
sw-enginecomponent):
| Product | Affected versions | Patched versions |
|---|---|---|
| Plesk for Linux (sw-engine, part of Plesk UI) | All versions | Planned as hotfix 18.0.80#11 & 18.0.81#4 |
| Plesk for Windows (sw-engine, part of Plesk UI) | All versions | Planned as hotfix 18.0.80#11 & 18.0.81#4 |
Note: for older versions of PHP (5.6, 7.2, 7.3) it is recommended to use paid TuxCare Extended Lifecycle Support for PHP.
Impact
Both vulnerabilities are rated critical (CVSS scores of 9.2). Remote code execution (RCE) is possible on affected PHP versions.
Call to action
Check the How to install Plesk updates article.
A fix is in development. The PHP vendor has scheduled the release of fixed PHP versions for 21 October 2026 at 14:00 UTC (PHP News Archive | 20 Oct 2026). After that, Plesk will rebuild the following and deliver them to Plesk servers:
- PHP builds from Plesk: 7.4 (EOL), 8.0 (EOL), 8.1 (EOL), 8.2, 8.3, 8.4, 8.5
- Plesk Obsidian 18.0.80 and 18.0.81 will receive a fix for
sw-engine(PHP engine used by Plesk itself)
This article will be updated with the patched versions and mitigation steps as soon as they are available.
Fixes for Plesk for Linux are already available for PHP 8.2 (as 8.2.35), 8.3 (as 8.3.36), 8.4 (as 8.4.27) and 8.5 (as 8.5.12). Older versions (7.4, 8.0, 8.1) don't have fixes yet.
Fixes for Plesk for Windows are not available yet.
How to check PHP version on Plesk server:
- Log into Plesk
- Navigate to Tools & Settings > PHP Settings menu. Versions should be reflected in handler names:
- Connect to the server via SSH
-
Execute the command below for corresponding PHP version (8.3 is used in this example):
# /opt/plesk/php/8.3/bin/php -v
PHP 8.3.36 (cli) (built: Oct 21 2026 08:04:57) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.36, Copyright (c) Zend Technologies
with Zend OPcache v8.3.36, Copyright (c), by Zend Technologies
Comments
I updated PHP 8.5 on my server, running Debian 12.15, per the instructions at php.net. php --version now reports 8.5.12. What to I need to do on the Plesk end to be protected?
yum update is not showing any new php packages yet. (This is on an alma9 and rocky 8 server)
Update:
yum clean metadata
yum makecache
yum check-update 'plesk-php*'
However, now I am getting public key for <package> not installed
When will the update be visible in Plesk?
Great to see you will also support older PHP versions. I know it is early to say, but is there any timeframe in mind?
where to find the security patch for Plesk Obsidian 18.0.81 Update #3 (Ubuntu 20.04.6 LTS) ? nothing is available via apt update/upgrade :-(
[UPDATE: update has been release thru apt and successfully applied. Thanks]
Older PHP versions (7.4, 8.0, 8.1) don't have fixes yet?!
Why not? We need to pay even more for our Plesk licenses?
Older PHP versions will come, but needs time a bit, I am sure Plesk team is working hard on it.
If the PHP updates do not install via yum, they will via Plesk update (GUI or CLI) as that will install the necessary keys.
Can you tell in which order you plan to release the missing fixes? Would be interesting also when new sw-engine can be expected? Thanks.
Michel vd Lingen : "Older PHP versions (7.4, 8.0, 8.1) don't have fixes yet?!
Why not?" --→ please read the main post above you are commenting on before complaining.
a.) because they are EOL, the current versions are patched first (every other way to handle this would cause delays)
b.) but even the EOL versions will receive updates, see above
c.) If you chose to use outdated software, you can also choose to book additional maintenance services. Your freedom, your choice, your responsibility
@plesk team: Thanks to everyone at Plesk team for doing such a great job, keeping us posted and fixing SEVERAL PHP versions even for EOL Ubuntu releases that fast :-) You rock!
Assuming everyone is hogging the Plesk network but are you guys facing Gateway issues and having to log in as root (compared to it was auto logging you in before)?
Tx
Will the update be avaliable in GUI, if not please post procedure to update !
SSH run:
plesk installer update
will also fix the apt key issues in previous messages
Paul Wolthuis “When will the update be visible in Plesk?”
Great question I think many of us are wondering the same.
It always seems to be a little faster via SSH, e. g. using PuTTY:
---
plesk version
plesk installer --select-release-current --reinstall-patch --upgrade-installed-components
---
Then query via (for php 8.3, swap for 8.4 or 8.5 if you use them):
---
/opt/plesk/php/8.3/bin/php -v | head -1; /usr/local/psa/admin/bin/php -v | head -1; plesk version | head -2; pgrep -a php-fpm
----
At DirectAdmin they provide excellent support! They will even provide fixes for older PHP-version e.g. PHP 5.6, PHP 7.0, PHP 7.1, PHP 7.2 and PHP 7.2!
Quote by DirectAdmin employee fln:
PHP versions 7.3 - 5.6 does not yet have a patch, we wanted to release what we have as soon as possible. Once we have patches for older PHP we will release them.
Why can't Plesk do this for their customers? Weird. We are paying enough as it is!
Is there an ETA available for 7.4, etc.?
via SSH, the PHP update deployed fine an hour ago already.
Be aware Plesk GUI also uses php and needs to be patched separately (as mentioned in the original post), 18.0.81#4 was not visible for me so far.
Until it's patched, IMHO it's better to turn the Plesk Panel (GUI) off - took me about 15 to 30 minutes to figure that out, so I'll hope this will save you others some time:
1.) Make sure you have external SSH access that's working (e. g. via PuTTY)
2.) SSH
---
systemctl stop sw-cp-server
systemctl is-active sw-cp-server
----
should show “inactive”
3.) periodically check for 18.0.81.4:
---
plesk installer --select-release-current --upgrade-installed-components
plesk version | head -1
/usr/local/psa/admin/bin/php -v | head -1
---
4.) Once that returned version 4, restart panel:
----
systemctl start sw-cp-server
systemctl is-active sw-cp-server
---
Rainer Z you are really short sighted? How many server do you have active? Probably less than 100 or perhaps even less than 10? Compare that situation to ours (over 1200 servers; not all Plesk luckily). And do the math on the amount of hosting accounts and think again on how many people do NOT update their website (Wordpress, custom PHP, whatever). Oh well. You are clearly shortsighted. Haha.
Vladimir Levchuk : Thanks a lot for keeping us posted here and the great article above, clearly showing what to do, what it already patched, what is planned to be released soon and even mentioning an option for PHP version hat have been EOL for years.
You made my day, helped me solve this fast and you + your team totally rock! Kudos to you and keep up the great work.
Completely agree with Rainer Z comment!
In regards to Rainer Z's remark:
c.) If you chose to use outdated software, you can also choose to book additional maintenance services. Your freedom, your choice, your responsibility
You are really short sighted aren't you?! Like I chose what our hosting customers are running? Really…
Rainer Z member since 32 minutes ago hahahaha. Byebye.
Update, applying a Plesk update worked.
Please release the update for Windows soon.
Michel vd Lingen, short sighted is letting customers run EOL versions and hoping a third party vendor will magically save you from disaster if that's your business model. I completely understand this issue, I've got 500+ Plesk servers myself. However, if you have that many servers, you would also hopefully have config management that allow you to easily detect, update, confirm as Plesk updates become available. We had the 8.2+ patches out within minutes of them releasing them. We had the plesk ports blocked to all servers within minutes of this issue disclosure. We are completely exposed for customers running php 7.4 apps, but they knowingly chose to acknowledge their need to keep using an EOL php because they couldn't, wouldn't, didn't feel like updating their apps to 8.x compatibility. That's life, and if they get hacked before Plesk has a 7.4, they're going to be wishing they didn't make that decision. We're certainly wishing they didn't as well, but your choices come down to force people to update and risk the business churn that comes with that, or don't and risk the churn that comes from them getting hacked due to their own bad decisions. The former is probably a better stance, the latter will make you more money.
Plesk certainly got the first patches out quick. I'm still waiting on Tuxcare two hours later.
plesk installer update
plesk bin php_handler --list
Does anyone know if the TuxCare Extended Lifecycle Support has deployed update for the older PHP versions?
Tools & Settings > PHP Settings
Is disabling a particular PHP version sufficient for securing a server or must it be uninstalled if it's not in use by any sites?
eCom Seller mr big shot! Haha. IDC how you run you business or whatever. We cannot force customers who are on Plesk servers and are using outdated or custom PHP applications to f0*k them over by forcing them to PHP 8.5. Maybe that is normal in your business, not in ours.
Anyways, I have had enough. Will wait for Tuxcare instead for our loyal customers.
> Is disabling a particular PHP version sufficient
I would expect so, if it can't run. Uninstalling won't hurt of course.
Michel vd Lingen sounds like you've already f'd your customers over by letting them run EOL versions and hoping for the best. Like I said, I'm in the same boat, with thousands of websites on php versions not covered yet. Except the difference between you and I apparently is that we mandate customers execute an agreement acknowledging we're making an end of life PHP version available to them at their own risk, and today is that risk. If you did nothing of the sort, congrats, your customers probably had no idea they were sitting here with a time bomb and they'll blame you instead of themselves.
Please sign in to leave a comment.