Articles in this section

Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk

Leonardo Neissinger Soares
Updated
kb: security kb: ai-created

Situation

Two security vulnerabilities were discovered in PHP. As a result, all PHP versions shipped with Plesk are also affected. These security vulnerabilities have been identified as CVE-2026-109618 and CVE-2026-109619.

Affected product version

  • PHP on Plesk Obsidian for Linux:
Product Affected versions Patched versions
PHP 8.5 8.5.11 and below 8.5.12
PHP 8.4 8.4.26 and below 8.4.27
PHP 8.3 8.3.35 and below 8.3.36
PHP 8.2 8.2.34 and below 8.2.35
PHP 8.1 (EOL) All versions In development
PHP 8.0 (EOL) All versions In development
PHP 7.4 (EOL) All versions In development
  • PHP on Plesk Obsidian for Windows:
Product Affected versions Patched versions
PHP 8.5 8.5.11 and below In development
PHP 8.4 8.4.26 and below In development
PHP 8.3 8.3.35 and below In development
PHP 8.2 8.2.34 and below In development
  • Plesk Obsidian (sw-engine component):
Product Affected versions Patched versions
Plesk for Linux (sw-engine, part of Plesk UI) All versions Planned as hotfix 18.0.80#11 & 18.0.81#4
Plesk for Windows (sw-engine, part of Plesk UI) All versions Planned as hotfix 18.0.80#11 & 18.0.81#4

Note: for older versions of PHP (5.6, 7.2, 7.3) it is recommended to use paid TuxCare Extended Lifecycle Support for PHP.

Impact

Both vulnerabilities are rated critical (CVSS scores of 9.2). Remote code execution (RCE) is possible on affected PHP versions.

Call to action

Check the How to install Plesk updates article. 

A fix is in development. The PHP vendor has scheduled the release of fixed PHP versions for 21 October 2026 at 14:00 UTC (PHP News Archive | 20 Oct 2026). After that, Plesk will rebuild the following and deliver them to Plesk servers:

  • PHP builds from Plesk: 7.4 (EOL), 8.0 (EOL), 8.1 (EOL), 8.2, 8.3, 8.4, 8.5
  • Plesk Obsidian 18.0.80 and 18.0.81 will receive a fix for sw-engine (PHP engine used by Plesk itself)

This article will be updated with the patched versions and mitigation steps as soon as they are available.

Fixes for Plesk for Linux are already available for PHP 8.2 (as 8.2.35), 8.3 (as 8.3.36), 8.4 (as 8.4.27) and 8.5 (as 8.5.12). Older versions (7.4, 8.0, 8.1) don't have fixes yet.

Fixes for Plesk for Windows are not available yet.

How to check PHP version on Plesk server:

In Plesk UI:
  1. Log into Plesk
  2. Navigate to Tools & Settings > PHP Settings menu. Versions should be reflected in handler names:

Plesk-php-handlers.png

In CLI (Linux):
  1. Connect to the server via SSH

  2. Execute the command below for corresponding PHP version (8.3 is used in this example):

    # /opt/plesk/php/8.3/bin/php -v
    PHP 8.3.36 (cli) (built: Oct 21 2026 08:04:57) (NTS)
    Copyright (c) The PHP Group
    Zend Engine v4.3.36, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.36, Copyright (c), by Zend Technologies

Was this article helpful?

Comments

33 comments
Date Votes
  • Avatar
    Markus Oestreicher

    When are Windows updates expected to be released?

    1
  • Avatar
    Gustavo Ramos

    PHP vendor has already released Windows NTS builds for PHP 8.3.36 and PHP 8.2.35 on windows.php.net. 

    0
  • Avatar
    Charlie Evans

    Any rough idea when 7.4 might be ready? 

    0

Please sign in to leave a comment.