Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[JVG]

I understand we may not know yet but, will disabling hosting on affected domains (below patched PHP versions) be enough to temporarily mitigate the exploit?

 

[frg62]

Some news from plesk :
Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk

A fix is in development. The PHP vendor has scheduled the release of fixed PHP versions for 21 October 2026 at 14:00 UTC (PHP News Archive | 20 Oct 2026). After that, Plesk will rebuild the following and deliver them to Plesk servers:

PHP builds from Plesk: 7.4 (EOL), 8.0 (EOL), 8.1 (EOL), 8.2, 8.3, 8.4, 8.5
Plesk Obsidian 18.0.80 and 18.0.81 will receive a fix for sw-engine (PHP engine used by Plesk itself)

You mean that Plesk will be able to provide patches for PHP 7.4 (EOL), 8.0 (EOL), 8.1 (EOL)?

If yes, this are excellent news.

 

[Mehl]

Just now: RELEASED!

PHP: News Archive - 2026

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

www.php.net

 

[Mehl]

Just now: RELEASED!

PHP: News Archive - 2026

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

www.php.net

sorry, that was an old article ... look at the start page!

PHP

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

www.php.net

 

[Mehl]

is plesk important enough to be included in:
"Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages."

 

[LKNessy]

Updates are available via the plesk updater.

Thanks for the fast reaction here Plesk.

 

[Sebahat.hadzhi]

Hi, everyone. PHP 8.2-8.5 updates for Linux have been published. The rest of the builds are still in progress.

 

[Mehl]

I have updated all 8.3, 8.4 and 8.5 ... Thanks Plesk for beiing so fast!

 

[Ladylinux]

Apt Update Bookworm. This is not helping

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP82_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP83_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP84_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96

 

[klowet]

I think Plesk update is down

Error: Unable to receive update information for the package(s)

With an apt-update (Debian), I get:

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP82_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP83_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP84_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP85_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Failed to fetch http://autoinstall.plesk.com/PHP82_17/dists/bookworm/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Failed to fetch http://autoinstall.plesk.com/PHP83_17/dists/bookworm/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Failed to fetch http://autoinstall.plesk.com/PHP84_17/dists/bookworm/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Failed to fetch http://autoinstall.plesk.com/PHP85_17/dists/bookworm/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Some index files failed to download. They have been ignored, or old ones used instead.

 

[LKNessy]

Use the plesk updater/installer in the backend. Seems like apt-update is having some issues due to cache etc.

 

[klowet]

Same issue in Plesk admin:

 

[sneppa]

Thank you plesk for the fast reaction - all servers are updated (through the interface, apt-get had some issues)

 

[Tjerk Visser]

How long wil this update take? It seems to be hanging here as well.

 

[H.W.B]

I updated the server via components update. Everything is fine. No problems!!!

 

[LKNessy]

Did you try Tools & Settings -> Plesk -> Updates?

 

[Monty]

I think Plesk update is down


With an apt-update (Debian), I get:

Use the cli:

plesk installer update
apt clean all
apt update
apt upgrade

 

[George Labro]

I have upgraded Plesk's managed PHP versions but it seems that the Admin Panel's PHP has not been updated? Any ideas?

# /usr/local/psa/admin/bin/php -v
PHP 8.4.24 (cli) (built: Aug 27 2026 07:14:20) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.4.24, Copyright (c) Zend Technologies
with Zend OPcache v8.4.24, Copyright (c), by Zend Technologies

 

[Tjerk Visser]

Browser back button did the trick

 

[mike_tcis]

A core php developer posted that only patching will solve the problem.

Gina Peter Banyard (@[email protected])

@[email protected] The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.

phpc.social

This fix works prior to PHP being invoked, so it will work. But it breaks a lot of other things, but is better than getting compromised.