Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[kyrill71]

Any ETA on 18.0.81#4?

 

[pleskpanel]

Loving that cPanel note for the PHP runtime used by WP Toolkit in the change log but where is the one for sw-engine?

 

[Powernerd]

Just wanted to say thank you to the Plesk team for how you handled php2shell today.
Much appreciated, and good luck with the sw-engine fix.

 

[Martin Dias]

Loving that cPanel note for the PHP runtime used by WP Toolkit in the change log but where is the one for sw-engine?

It will be available soon, it's going through the build pipeline

 

[brother4]

It's been a long day for some people today. And if you take a look at x, PHP wasn't the only big thing that happened today...

 

[andon]

We also had to take all Plesk admin interfaces offline. When will the 18.0.81 Update 4 be released? Can you say whether it will be a matter of 30 minutes or a few hours?

 

[Lucas K.]

We'd like to call it a day—it's been a long one—but we're waiting for the sw-engine update. So is it worth the wait because it's coming soon, or will it take a few more hours? If so, we'd like to call it a day. More information would be helpful.

 

[the-real-jnthn]

GTA 6 before sw-engine update?

 

[brother4]

V2 Scan Command:

printf 'php2shell: Vulnerability Scan CVE-2026-109618 and CVE-2026-109619\n'; pv=$(plesk version | awk '/^Product version:/{print $NF}'); req=18.0.81.4; [[ $pv == 18.0.80.* ]] && req=18.0.80.11; dpkg --compare-versions "$pv" ge "$req" && s=PATCHED || s=VULNERABLE; printf 'Plesk %s: %s\n' "$pv" "$s"; for p in /opt/plesk/php/*/bin/php; do [[ -x "$p" ]] || continue; l=$("$p" -v | head -n1); v=${l#PHP }; v=${v%% *}; case ${v%.*} in 8.2) req=8.2.35;; 8.3) req=8.3.36;; 8.4) req=8.4.27;; 8.5) req=8.5.12;; 7.4|8.0|8.1) d=$(date -d "$(awk '{print $5,$6,$7}' <<< "$l")" +%Y%m%d 2>/dev/null); if [[ -z $d ]]; then s=VERIFY; elif [[ $d -ge 20261021 ]]; then s="PATCHED (backport)"; else s=VULNERABLE; fi; printf 'PHP %s: %s\n' "$v" "$s"; continue;; 5.*|7.*) printf 'PHP %s: TUXCARE ELS / VERIFY\n' "$v"; continue;; *) printf 'PHP %s: VERIFY\n' "$v"; continue;; esac; dpkg --compare-versions "$v" ge "$req" && s=PATCHED || s=VULNERABLE; printf 'PHP %s: %s\n' "$v" "$s"; done

Example:

php2shell: Vulnerability Scan CVE-2026-109618 and CVE-2026-109619
Plesk 18.0.81.3: VULNERABLE
PHP 8.3.36: PATCHED
PHP 8.4.27: PATCHED
PHP 8.5.12: PATCHED

Commands when patch available:

plesk installer --select-release-current --upgrade-installed-components
systemctl start sw-cp-server

 

[ChristophRo]

looks like the update is here....
I'm currently updating all our server

 

[mow]

Commands when patch available:

plesk installer --select-release-current --upgrade-installed-components
systemctl start sw-cp-server

[...]Unpacking sw-engine (8.81.1-debian.11.261021.1037) over (8.81.0-debian.11.260903.0901) ...

 

[brother4]

Finally - Good night!

php2shell: Vulnerability Scan CVE-2026-109618 and CVE-2026-109619
Plesk 18.0.81.4: PATCHED
PHP 8.3.36: PATCHED
PHP 8.4.27: PATCHED
PHP 8.5.12: PATCHED

Keep an eye on this and GitLab as well:

• Security vulnerabilities: On October 21, 2026, Node.js disclosed 10 security vulnerabilities, including 4 rated high severity. The most critical, CVE-2026-111497, is a Brotli decoder memory corruption flaw that could potentially enable Remote Code Execution (RCE).
• Affected versions: Node.js 22.x, 24.x, and 26.x before the respective security updates. Older, unsupported versions may also be vulnerable.
• Security patches available: Fixed in Node.js 22.23.4, 24.22.1, and 26.12.1, released on October 21, 2026. Other high-severity CVEs include CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069, affecting DNS and TLS security checks.
• Source: Official Node.js Security Advisory

 

[Martin Dias]

18.0.81.4 was released
18.0.80.11 will follow soon