Resolved critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)

[iForced]

Server operating system version

Server2025

Plesk version and microupdate number

18.0.81 Update #3

What is the ETA for Windows? I don't see updates yet

 

[matsnijman]

Any update on this?

 

[iForced]

Plesk installer update still says "You already have the latest version of product(s) and all the selected components installed. Installation will not continue."

 

[iForced]

https://media.tenor.com/Dz9GFJ9ngPQAAAAM/me-waiting-for-v-movie-trailer-on-prime-mr-bean.gif

 

[galileon]

@Sebahat.hadzhi as you were able to give insights on the linux pipeline do you have an ETA for the Windows builds?

 

[iForced]

Still nothing.. crazy..

 

[galileon]

Whats anoying me the most is, that there is communication on the linux builds and a shipped build was done an hour after release for the actively maintained versions; Such patches exist for windows as well and just need to be rebuild/shipped with an update. I know Windows Pipelines take longer but its over 3 hours now since release.

If it is not feasible to run so many releases at once, an upgrade-by-hand guide should have been published.

 

[iForced]

They then should have proactively have some communication it takes longer for Windows but working on it or something. You can expect people to wonder when the Windows side is being handled. If you can answer somewhere else, you can answer here.

 

[galileon]

I actually do understand that it is a critical situation, maybe comparable to the crowdstrike issue 2 years ago. The devs for windows might be different ones than for linux, different location/timezone whatever... but yeah at this point any official notice other than: 'under development / not yet available' would be enough

 

[Martin Dias]

We are working on the updates, and will release them as soon as possible, at the moment no ETA can be provided yet other than soon

 

[galileon]

Patches availabe; just installed :=) @iForced

 

[iForced]

I was just about to hit reply to say it Thanks got them

Patches availabe; just installed :=) @iForced

 

[matsnijman]

Is this official yet? I can see some packages, but Plesk itself is running still on PHP 8.4.25 after installing.
So i guess it's not all fixed?

 

[matsnijman]

So i guess it's still waiting on these:

Plesk for Windows (sw-engine, part of Plesk UI) -> Planned as hotfix 18.0.80#11 & 18.0.81#4

Any ETA on this?

 

[galileon]

Any ETA on this? => Somewhen this night hopefully

 

[Martin Dias]

we still working on it to release it as soon as possible

 

[galileon]

Am i correct with disabling Plesk Management Service for now so sw-engine is not running and therefore server should be safe?

 

[galileon]

sw-engine?

what is "sw-engine" used for | Plesk Forum

what is "sw-engine" used for

today i observed a strange procedure in top command named sw-engine which takes me a mount of memory resource. what makes it "strange" and "naughty" is that it turns up periodically. for instance it means for the first 4 minutes, it appears as usual, and then for the next 4 minutes it...

talk.plesk.com

 

[Lucas K.]

When will updates 18.0.80#11 and 18.0.81#4 finally be released? It can't be right that the most important update is still pending! Other panels have had this sorted out for a long time now; with just the PHP updates, only the customers' websites are secure—the main interface isn't yet!

 

[galileon]

Plesk Obsidian 18.0.81 Update 4
changelog has been written - upgrade running