Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[Goose]

Thanks, the plesk installer update in CLI have made the necessary update for my websites.

Still, as reported:

However, the PHP used by the Plesk panel itself (sw-engine) has not been updated yet.

Same for me.

 

[Sebahat.hadzhi]

Only tracking or compiling/backporting?

All I know is they are working on providing backported fixes for the versions they support. However, as they are a third-party service, I have no internal information on what exactly is being done on their end.

I'm sorry i don't understand. For older versions (7.4 to 8.1), even on Plesk linux, are these builds/releases in progress ? Do you know when we are going to be able to update ?

Yes, they are in progress. The builds are complete and they are in testing phase. They should be released soon if everything goes well.

 

[George Labro]

For anyone interested, this is what I implemented until an update for sw-engine exists. I suggest to either enable a Firewall rule to allow access to port 8443 only from known IPs and/or use an SSH tunnel to access the admin panel.

 

[manni]

@Sebahat.hadzhi
The fix for old PHP releases will be done by TuxCare - but do I need the ELS for CentOS license or the ELS for PHP license then ?

 

[Linulex]

All I know is they are working on providing backported fixes for the versions they support. However, as they are a third-party service, I have no internal information on what exactly is being done on their end.



Yes, they are in progress. The builds are complete and they are in testing phase. They should be released soon if everything goes well.

Will these be available via the plesk repositry? Plesk makes them available and i have installed these PHP versions via Plesk so i believe Plesk should provide the updates.

If Plesk doesn't make them available and they stay in the repositry then they will knowingly and willingly distribute unsafe versions.

Regards
Jan

 

[filipe.carreira]

What's the status for the Windows builds: Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk
And will the builds for EOL will backported or not?
You info the on article above that you would backport those versions but it has since been removed.