Articles in this section

Vulnerability CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): Remote code execution in PHP shipped with Plesk

Vladimir Levchuk
Updated
kb: security kb: ai-created

Situation

Two security vulnerabilities were discovered in PHP. As a result, all PHP versions shipped with Plesk are also affected. These security vulnerabilities have been identified as CVE-2026-109618 and CVE-2026-109619 and are also known as PHP2Shell.

Affected product version

  • PHP on Plesk Obsidian for Linux:
Product Affected versions Patched versions
PHP 8.5 8.5.11 and below 8.5.12
PHP 8.4 8.4.26 and below 8.4.27
PHP 8.3 8.3.35 and below 8.3.36
PHP 8.2 8.2.34 and below 8.2.35
PHP 8.1 (EOL) 8.1.34 (built before 21 Oct 2026) 8.1.34 (built on 21 Oct 2026)
PHP 8.0 (EOL) 8.0.30 (built before 21 Oct 2026) 8.0.30 (built on 21 Oct 2026)
PHP 7.4 (EOL) 7.4.33 (built before 21 Oct 2026) 7.4.33 (built on 21 Oct 2026)
  • PHP on Plesk Obsidian for Windows:
Product Affected versions Patched versions
PHP 8.5 8.5.11 and below 8.5.12
PHP 8.4 8.4.26 and below 8.4.27
PHP 8.3 8.3.35 and below 8.3.36
PHP 8.2 8.2.34 and below 8.2.35
  • Plesk Obsidian (sw-engine component):
Product Affected versions Patched versions
Plesk for Linux (sw-engine, part of Plesk UI)
  • Plesk Obsidian 18.0.80 Update 10 and below 
  • Plesk Obsidian 18.0.81 through 18.0.81 Update 3
  • Plesk Obsidian 18.0.80 Update 11
  • Plesk Obsidian 18.0.81 Update 4
Plesk for Windows (plesk-engine, part of Plesk UI)
  • Plesk Obsidian 18.0.80 Update 10 and below 
  • Plesk Obsidian 18.0.81 through 18.0.81 Update 3
  • Plesk Obsidian 18.0.80 Update 11 
  • Plesk Obsidian 18.0.81 Update 4

Note: for older versions of PHP (5.6, 7.2, 7.3) it is recommended to use paid TuxCare Extended Lifecycle Support for PHP.

Impact

Both vulnerabilities are rated critical (CVSS scores of 9.2). Remote code execution (RCE) is possible on affected PHP versions.

Call to action

Update Plesk to the latest available version.

A fix is available for most affected versions. The PHP vendor released the fixed PHP versions on 21 October 2026 at 14:00 UTC (PHP News Archive | 21 Oct 2026). 

Fixes for Plesk for Linux are already available for PHP 8.2 (as 8.2.35), 8.3 (as 8.3.36), 8.4 (as 8.4.27) and 8.5 (as 8.5.12). 
Fixes for EOL PHP versions on Plesk for Linux 7.4.33, 8.0.30, 8.1.34 have the same version number, but different build date. Versions built on 21 October 2026 have fixes included.

Fixes for Plesk for Windows are available for PHP 8.2 (as 8.2.35), 8.3 (as 8.3.36), 8.4 (as 8.4.27) and 8.5 (as 8.5.12)

Change Log for Plesk Obsidian / PHP Updates

Fixes for sw-engine/plesk-engine (PHP engine used by Plesk itself) are already available in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11 for both Plesk for Linux and Plesk for Windows:

Check the Plesk version installed on the server. 

Additional Information:

If the update fails with The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96 error (on Ubuntu/Debian), check the Unable to update Plesk: The following signatures couldn't be verified because the public key is not available article.

How to check PHP version on Plesk server:

In Plesk UI:
  1. Log into Plesk.
  2. Navigate to Tools & Settings > PHP Settings menu. Versions should be reflected in handler names:

Plesk-php-handlers.png

In CLI (Linux):
  1. Connect to the server via SSH

  2. Execute the command below for corresponding PHP version (8.3 is used in this example):

    # /opt/plesk/php/8.3/bin/php -v
    PHP 8.3.36 (cli) (built: Oct 21 2026 08:04:57) (NTS)
    Copyright (c) The PHP Group
    Zend Engine v4.3.36, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.36, Copyright (c), by Zend Technologies

Was this article helpful?

Comments

71 comments
Date Votes
  • Avatar
    eCom Seller

    Michel vd Lingen, short sighted is letting customers run EOL versions and hoping a third party vendor will magically save you from disaster if that's your business model.  I completely understand this issue, I've got 500+ Plesk servers myself.  However, if you have that many servers, you would also hopefully have config management that allow you to easily detect, update, confirm as Plesk updates become available.  We had the 8.2+ patches out within minutes of them releasing them.  We had the plesk ports blocked to all servers within minutes of this issue disclosure.  We are completely exposed for customers running php 7.4 apps, but they knowingly chose to acknowledge their need to keep using an EOL php because they couldn't, wouldn't, didn't feel like updating their apps to 8.x compatibility.  That's life, and if they get hacked before Plesk has a 7.4, they're going to be wishing they didn't make that decision.  We're certainly wishing they didn't as well, but your choices come down to force people to update and risk the business churn that comes with that, or don't and risk the churn that comes from them getting hacked due to their own bad decisions.  The former is probably a better stance, the latter will make you more money.

    Plesk certainly got the first patches out quick.  I'm still waiting on Tuxcare two hours later.

    3
  • Avatar
    Utku Karaaslan User

    plesk installer update
    plesk bin php_handler --list
     

    2
  • Avatar
    Nico Smit

    Does anyone know if the TuxCare Extended Lifecycle Support has deployed update for the older PHP versions?

    0
  • Avatar
    Steve Yates

    > If the PHP updates do not install via yum, they will via Plesk update (GUI or CLI) as that will install the necessary keys.

    It does not, unfortunately, at least on Debian 12 and 13. System Updates page shows error “Error: Unable to receive update information for the package(s).” apt update shows:

    W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error:   http://autoinstall.plesk.com/PHP82_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not availa  ble: NO_PUBKEY 5B6AB2160B50DB96
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error:   http://autoinstall.plesk.com/PHP83_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not availa  ble: NO_PUBKEY 5B6AB2160B50DB96
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error:   http://autoinstall.plesk.com/PHP84_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not availa  ble: NO_PUBKEY 5B6AB2160B50DB96
W: Failed to fetch http://autoinstall.plesk.com/PHP82_17/dists/bookworm/InRelease  The following signatures couldn't be verified because the   public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Failed to fetch http://autoinstall.plesk.com/PHP83_17/dists/bookworm/InRelease  The following signatures couldn't be verified because the   public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Failed to fetch http://autoinstall.plesk.com/PHP84_17/dists/bookworm/InRelease  The following signatures couldn't be verified because the   public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Some index files failed to download. They have been ignored, or old ones used instead.
    0
  • Avatar
    Kevin Kolstad

    Tools & Settings > PHP Settings
    Is disabling a particular PHP version sufficient for securing a server or must it be uninstalled if it's not in use by any sites? 

    1
  • Avatar
    Michel vd Lingen

    eCom Seller mr big shot! Haha. IDC how you run you business or whatever. We cannot force customers who are on Plesk servers and are using outdated or custom PHP applications to f0*k them over by forcing them to PHP 8.5. Maybe that is normal in your business, not in ours.

    Anyways, I have had enough. Will wait for Tuxcare instead for our loyal customers.

    -3
  • Avatar
    Steve Yates

    > Is disabling a particular PHP version sufficient

    I would expect so, if it can't run.  Uninstalling won't hurt of course.

    0
  • Avatar
    Frank Gude

    Hi All,


    Update im Plesk hat wunderbar funktioniert, aber ich denke wir haben uns zu dem jetzigen Zeitpunkt zu früh gefreut, denn in der neuen gepatchten Version soll noch ein weiteres ungefixtes Issue sein: 

    https://fedi.katze.sh/@elise/117479383739450605

    Greetings
    Franky

    0
  • Avatar
    eCom Seller

    Michel vd Lingen sounds like you've already f'd your customers over by letting them run EOL versions and hoping for the best.  Like I said, I'm in the same boat, with thousands of websites on php versions not covered yet.  Except the difference between you and I apparently is that we mandate customers execute an agreement acknowledging we're making an end of life PHP version available to them at their own risk, and today is that risk.  If you did nothing of the sort, congrats, your customers probably had no idea they were sitting here with a time bomb and they'll blame you instead of themselves.

    -3
  • Avatar
    Markus Oestreicher

    When are Windows updates expected to be released?

    0
  • Avatar
    Gustavo Ramos

    PHP vendor has already released Windows NTS builds for PHP 8.3.36 and PHP 8.2.35 on windows.php.net. 

    0
  • Avatar
    Charlie Evans

    Any rough idea when 7.4 might be ready? 

    2
  • Avatar
    Fabian Niesen

    I updated e verything available, even, over ssh (Yum update). But the FPM with NGINX is still on 8.5.11. The other PHP is already at 8.5.12. Any futher tips, did I miss something?

    0
  • Avatar
    icez network

    use command ‘plesk installer update’ to upgrade your php version. yum update/apt upgrade do nothing since there's some repository change required from plesk to get the update.

    1
  • Avatar
    Steve Yates

    I think, some paste-o's in this KB:

    > Product: PHP 8.1 (EOL)
    > Affected Version: 7.4.33 (built before 21 Oct 2026)
    > Patched Version: 7.4.33 (built on 21 Oct 2026)

     

    > FPM with NGINX is still on 8.5.11

    Did you restart services? Also the update for Plesk is not out yet.

    1
  • Avatar
    Fabian Niesen

    I restarted the Service, done the Plesk Update and even restarted the server. 

    Fun fact, the new RPM is installed: 

    yum install plesk-php85-fpm.x86_64
    Last metadata expiration check: 0:01:06 ago on Wed 21 Oct 2026 09:24:13 PM CEST.
    Package plesk-php85-fpm-8.5.12-0redhat.9.261021.1135.x86_64 is already installed.
    Dependencies resolved.
    Nothing to do.
    Complete!
    But the UI in Plesk still show the old version:     8.5.11 FPM-Anwendung

    Fast CGI and CGI are already at 8.5.12, but thoose are not selectable with NGINX.

    1
  • Avatar
    Fabian Niesen

    Update: It's a bug in the UI, after deinstalling PHP 8.2 (No longer needed), the UI Updated the versions in the PHP Overview for FPM… *arrrrggghhhhh*

    2
  • Avatar
    Mendel Nemanov

    @Plesk any chance of a 7.4 update for windows?

    0
  • Avatar
    Steve Yates
    (Edited )

     public key is not available: NO_PUBKEY 5B6AB2160B50DB96

    Fix for Debian 12/13, assuming the file /etc/apt/keyrings/plesk.gpg exists (it did on all our broken ones):

    curl -fsSL https://autoinstall.plesk.com/plesk.gpg -o /tmp/plesk-key.asc
cp -a /etc/apt/keyrings/plesk.gpg /etc/apt/keyrings/plesk.gpg.bak
gpg --batch --yes --dearmor -o /tmp/plesk-dearmored.gpg /tmp/plesk-key.asc
install -m 644 /tmp/plesk-dearmored.gpg /etc/apt/keyrings/plesk.gpg

    Then System Updates can detect new updates.

    Edit to show files in /etc/apt/keyrings:

    -rw-r--r-- 1 root root 4620 Oct 21 14:50 plesk.gpg
-rw-r--r-- 1 root root 2885 Oct 21 09:29 plesk.gpg.bak
    0
  • Avatar
    Remy Vaartjes

    Thank you Plesk Team for the fast release of the full patch on all php versions! Great work. Glad I am using Plesk.

    2
  • Avatar
    Charlie Evans

    Thanks Plesk! Please note the article likely specifies the incorrect versions on the table : PHP 8.1 (EOL) / PHP 8.0 (EOL)

    7.4.33 (built before 21 Oct 2026)

    7.4.33 (built on 21 Oct 2026)

     

    2
  • Avatar
    Youcef Nafa

    Updated successfully, thank you

    8.5.12-debian.11.261021.0916

    0
  • Avatar
    Christian Scheele

    Hi,
    very good job, i really appreciate your work and even updating the already EOL php versions were really fast.

    Thanks ! 

    1
  • Avatar
    Armin Admin
    (Edited )

    Hey Folks

    If someone struggles with identifying the installed php-module building date, here is how to check:
    Go in Plesk > Tools & Settings > Server Components [group Server Management] > search for appropriate php<version> and have a look at component version:

    php74 >> 7.4.33-ubuntu.22.04.261021.1344

    I assume the bold one means the building date in yymmdd.HHMM

    Thanks @team for your great and fast work.

    2
  • Avatar
    John Dee

    Why is the new PHP version 8.3.36 not showing up in my Plesk control panel?

    0
  • Avatar
    TLRDev

    Shout out to the hard work you all are doing at plesk to get this patched. I believe this is considered a historical security vulnerability. Those angry about it not instantly available, calm down, this is a major wow moment. not a typical security issue. The fastest way to patch the php is via ssh. for commands use at your own risk, but chatgpt or codex. That is what i used for faster commands and reading outputs. I patched 2 vps servers in about 30 minutes. Once this plesk patch is ready (ya know because they dont want to wreck anyones server gui) it will either show on your refreshed gui panel, or you can keep checking ssh command “plesk installer update”. And the other person posted here “Plesk Panel (GUI) off”. Yes i agree, that is what i did.

    Thanks again plesk team!

    1
  • Avatar
    Oliver Jusinger

    I'm not sure I fully understood the discussion above.

    I've already updated Plesk itself manually, including resolving the recent GPG key issues. The system PHP version is now 8.3.36.

    However, as far as I understand, this only secures Plesk itself, not the PHP runtimes used by my websites. Those are still waiting for the updated Plesk PHP packages (currently Plesk Obsidian 18.0.81 Update #3).

    As a precaution, I've taken all my websites offline.

    Is there any solution other than waiting for Plesk to release Update #4? This is taking far too long considering the severity of the vulnerabilities.

    I really appreciate Plesk for making server administration easier. But right now, I find myself thinking back to the days when I managed everything directly on Debian. At least I wouldn't have had to keep my websites offline for this long while waiting for a vendor update.

    0
  • Avatar
    Keith Dawson

    I just ran “plesk installer update” and learned that 18.0.81.4 has happened. So I re-enabled the admin GUI.

    1
  • Avatar
    TLRDev
    (Edited )

    For anyone that needs clarification, here's a simple breakdown of the recent PHP security alert and what needs to be updated.

    Even if your Plesk admin panel says “Up to date,” that doesn't necessarily mean the PHP security vulnerability has been patched.

    The Plesk panel version and its internal PHP version are two different things.

    Check your Plesk internal PHP version. If it's still 8.4.25, you're looking for the security-fixed version 8.4.27 or higher, or an official Plesk-patched equivalent.

    1. Update your PHP versions.

    Make sure you're running the latest security-patched versions:

    • PHP 8.2 → 8.2.35
    • PHP 8.3 → 8.3.36
    • PHP 8.4 → 8.4.27
    • PHP 8.5 → 8.5.12

    2. Don't forget Plesk's internal PHP!

    Plesk uses its own PHP installation to operate its control panel. Updating the PHP versions used by your websites does NOT automatically update Plesk's internal PHP.

    You'll need to make sure Plesk releases and installs the appropriate security fix for that as well.

    3. Still running PHP 7.4 or other outdated versions?

    Those versions are end-of-life and no longer receive normal security updates. You'll need to upgrade to a supported PHP version or use a vendor that provides security backports.

    4. What if Plesk hasn't released its patch yet?

    Consider temporarily restricting access to Plesk's administration ports (8443 and 8880) until the security update is available. Make sure you have another way to administer your server, such as SSH access before doing so.

    Bottom line: Updating your website PHP versions is only part of the job. You also need to check Plesk's internal PHP and any older PHP versions installed on your server.

    You don't have to be a server expert to take this seriously. Just make sure you're patching ALL affected PHP installations, not only the ones running your websites.

    1
  • Avatar
    Oliver Jusinger

    I passed the topic to KI and I guess I am save. But I am not happy with the Plesk communication…

    KI summarize:

    Update: I finally figured out what was going on.

    Despite Plesk Obsidian still showing 18.0.81 Update #3, and plesk bin php_handler --list reporting PHP 8.5.11, the patched PHP 8.5.12 packages were already installed.

    I verified this directly:

    /opt/plesk/php/8.5/bin/php -v
PHP 8.5.12 (cli)

/opt/plesk/php/8.5/sbin/php-fpm -v
PHP 8.5.12 (fpm-fcgi)

    apt-cache policy plesk-php85-fpm also confirms that PHP 8.5.12 is installed.

    So, as it turns out, waiting for Plesk Obsidian Update #4 was unnecessary for securing the PHP runtime used by my websites. The Plesk PHP packages are updated independently of the Obsidian version.

    What I find particularly problematic is the lack of clarity in the update process:

    • The Plesk dashboard still shows Update #3.
    • The Plesk CLI reports an outdated PHP version.
    • The actual installed PHP binaries are already patched.
    • There is no clear indication that the PHP security update has been successfully applied to the websites.

    During a critical security incident, administrators need reliable information about which components are vulnerable and which have already been patched.

    I ended up taking all my websites offline unnecessarily because the available status information suggested that the security update was still missing.

    I appreciate Plesk as an administration platform, but I believe the update status and communication around security-critical PHP releases need significant improvement.

    At the very least, the documentation should clearly distinguish between Obsidian updates, the internal sw-engine runtime, and the separately maintained PHP packages used by hosted websites.

    0

Please sign in to leave a comment.