Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[nbejansen]

The PHP 7.4 and 8.0 versions are no longer available in the component selection. They are still installed on the server, but the updater doesn't pick up any updates. Does anybody know what could be wrong?

 

[pleskpanel]

Any word on the sw-engine update?

 

[Vince]

Updates for Plesk Linux PHP 7.4-8.1 are now available.

Wonderful, thx for the notification. Updates applied.

 

[Christian D]

Hello,
if anyone is not receiving updates and is hosting with STRATO, change the mirror URLs in plesk.list from the STRATO mirrors to autoinstall.plesk.com.

 

[nbejansen]

Are CloudLinux 9 builds for PHP 7.4 and 8.0 still pending?

 

[HHawk]

sw-engine?

 

[pleskpanel]

Yes, Plesk packages a seperate version of PHP for use with its own services. To date these have not been updated so while websites running on an updated Plesk server are no longer vulnerable, Plesk effectively still is until the version is updated.

If you run this and it comes back with PHP 8.4.25, then the Plesk panel itself becomes the attack vector:

/usr/local/psa/admin/bin/php -v

A release to address this as soon as possible would help to close that gap.