Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk

Vitalii Zhidkov

Updated October 20, 2026 21:06

kb: security kb: ai-created

Situation

Two security vulnerabilities were discovered in PHP. As a result, all PHP versions shipped with Plesk are also affected. These security vulnerabilities have been identified as CVE-2026-109618 and CVE-2026-109619.

Affected product version

Product	Affected versions	Patched versions
Plesk for Linux	All shipped PHP versions	Pending fix from the PHP vendor
Plesk for Windows	All shipped PHP versions	Pending fix from the PHP vendor

Impact

Both vulnerabilities are rated critical. Remote code execution (RCE) is possible on affected PHP versions.

Call to action

A fix is in development. Once the PHP vendor releases fixed versions, they will be included in Plesk PHP packages and delivered to Plesk servers.

This article will be updated with the patched versions and mitigation steps as soon as they are available.