Issue critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)

[iForced]

Server operating system version

Server2025

Plesk version and microupdate number

18.0.81 Update #3

What is the ETA for Windows? I don't see updates yet

 

[matsnijman]

Any update on this?

 

[iForced]

Plesk installer update still says "You already have the latest version of product(s) and all the selected components installed. Installation will not continue."

 

[iForced]

https://media.tenor.com/Dz9GFJ9ngPQAAAAM/me-waiting-for-v-movie-trailer-on-prime-mr-bean.gif

 

[galileon]

@Sebahat.hadzhi as you were able to give insights on the linux pipeline do you have an ETA for the Windows builds?

 

[iForced]

Still nothing.. crazy..

 

[galileon]

Whats anoying me the most is, that there is communication on the linux builds and a shipped build was done an hour after release for the actively maintained versions; Such patches exist for windows as well and just need to be rebuild/shipped with an update. I know Windows Pipelines take longer but its over 3 hours now since release.

If it is not feasible to run so many releases at once, an upgrade-by-hand guide should have been published.

 

[iForced]

They then should have proactively have some communication it takes longer for Windows but working on it or something. You can expect people to wonder when the Windows side is being handled. If you can answer somewhere else, you can answer here.

 

[galileon]

I actually do understand that it is a critical situation, maybe comparable to the crowdstrike issue 2 years ago. The devs for windows might be different ones than for linux, different location/timezone whatever... but yeah at this point any official notice other than: 'under development / not yet available' would be enough

 

[Martin Dias]

We are working on the updates, and will release them as soon as possible, at the moment no ETA can be provided yet other than soon

 

[galileon]

Patches availabe; just installed :=) @iForced

 

[iForced]

I was just about to hit reply to say it Thanks got them

Patches availabe; just installed :=) @iForced

 

[matsnijman]

Is this official yet? I can see some packages, but Plesk itself is running still on PHP 8.4.25 after installing.
So i guess it's not all fixed?

 

[matsnijman]

So i guess it's still waiting on these:

Plesk for Windows (sw-engine, part of Plesk UI) -> Planned as hotfix 18.0.80#11 & 18.0.81#4

Any ETA on this?

 

[galileon]

Any ETA on this? => Somewhen this night hopefully

 

[Martin Dias]

we still working on it to release it as soon as possible