Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[Lucas K.]

When will updates 18.0.80#11 and 18.0.81#4 finally be released? It can't be right that the most important update is still pending! Other panels have had this sorted out for a long time now; with just the PHP updates, only the customers' websites are secure—the main interface isn't yet!

 

[Lucas K.]

But hey, you guys are quick to raise prices—I guess that's about it, unfortunately. I hope this will be posted tonight.

 

[afuego]

Easy update; Go to Tools & Settings->Updates->Update Components.

To force Node.js updates and fix the vulnerabilities released today October 21:

plesk php -dauto_prepend_file=sdk.php '/opt/psa/admin/plib/modules/nodejs/scripts/nodejs-auto-update.php'

No updates will be released for PHP 8.1 or older.
No updates for end-of-life Node.js versions 27.3.1 or older

 

[Janko Falli]

@Sebahat.hadzhi any ETA on 18.0.81#4 hours passed....

 

[pleskuser67553]

Hello, I used the GUI update in Tools & Settings > Updates, it brought down the new patch versions for PHP 8 with changed version numbers, and also patches for 7.4.33, I understand that its version number does not change, but can you confirm, am I looking at the patched version? It would be super helpful if that article actually showed the build numbers, if possible..?

plesk-php74 7.4.33-1centos.7.261021.1344 (PLESK_17_PHP74)

 

[nbejansen]

Still missing CloudLinux 9 support for PHP 7.4 and 8.0...

 

[pleskuser67553]

Hello, I used the GUI update in Tools & Settings > Updates, it brought down the new patch versions for PHP 8 with changed version numbers, and also patches for 7.4.33, I understand that its version number does not change, but can you confirm, am I looking at the patched version? It would be super helpful if that article actually showed the build numbers, if possible..?

plesk-php74 7.4.33-1centos.7.261021.1344 (PLESK_17_PHP74)

I think I answered my own question, I used the CLI route to check the build date:

# /opt/plesk/php/7.4/bin/php -v
PHP 7.4.33 (cli) (built: Oct 21 2026 13:52:02) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with the ionCube PHP Loader + ionCube24 v14.4.0, Copyright (c) 2002-2025, by ionCube Ltd.
    with Zend OPcache v7.4.33, Copyright (c), by Zend Technologies

 

[Martin Dias]

Still missing CloudLinux 9 support for PHP 7.4 and 8.0...

We are aware, and it will be added soon too.

 

[jnthn]

Thanks for providing patches for 7.4–8.1!

 

[the-real-jnthn]

when will sw-engine be updated? after the next 12 price increases?

 

[pleskuser67553]

For anyone interested, this is what I implemented until an update for sw-engine exists. I suggest to either enable a Firewall rule to allow access to port 8443 only from known IPs and/or use an SSH tunnel to access the admin panel.

Add port 8447 for known IPs too

 

[kyrill71]

Any ETA on 18.0.81#4?

 

[pleskpanel]

Loving that cPanel note for the PHP runtime used by WP Toolkit in the change log but where is the one for sw-engine?

 

[Powernerd]

Just wanted to say thank you to the Plesk team for how you handled php2shell today.
Much appreciated, and good luck with the sw-engine fix.

 

[the-real-jnthn]

is your claude 5 hour limit full or why is there no update coming for sw-engine? maybe we can all chip in for another account for you?

 

[Martin Dias]

Loving that cPanel note for the PHP runtime used by WP Toolkit in the change log but where is the one for sw-engine?

It will be available soon, it's going through the build pipeline

 

[brother4]

It's been a long day for some people today. And if you take a look at x, PHP wasn't the only big thing that happened today...

 

[andon]

We also had to take all Plesk admin interfaces offline. When will the 18.0.81 Update 4 be released? Can you say whether it will be a matter of 30 minutes or a few hours?

 

[Lucas K.]

We'd like to call it a day—it's been a long one—but we're waiting for the sw-engine update. So is it worth the wait because it's coming soon, or will it take a few more hours? If so, we'd like to call it a day. More information would be helpful.

 

[the-real-jnthn]

GTA 6 before sw-engine update?