Security

Vulnerability CVE-2026-111497: Out-of-bounds write in Brotli bundled with PHP on Plesk for Windows
Vulnerability CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): Remote code execution in PHP shipped with Plesk
Vulnerability CVE-2026-107246 in Plesk's Site Import extension
Disabling root password sign-in over SSH
Disabling SSH sign-in for accounts with empty passwords
Security: phpMyAdmin 5.2.3 WebAuthn Two-Factor Authentication Bypass
Vulnerability CVE-2026-113386: IMAP command injection in Roundcube in Plesk
Trusted IP address is banned in Fail2Ban
Vulnerability CVE-2026-68492: Arbitrary code execution as root in Plesk via the Plesk RESTful API extension
Vulnerability CVE-2026-87898: Arbitrary code execution as root in Plesk's Site Import extension
Vulnerability CVE-2026-68489: Arbitrary code execution as root in Plesk's Node.js Toolkit and Ruby extensions
Vulnerability in Plesk's Backup Manager: symlink race during restore allows root privilege escalation
Vulnerability in Plesk's Backup Manager: unsigned backup header allows path traversal
Plesk is inaccessible from certain IP address, but the address is put to trusted list in Fail2Ban
How to enable secure TLS versions and ciphers in Plesk for Linux?