Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

brother4 · 2026-10-20T15:48:31-0700

The PHP team has announced an emergency security release for October 21, 2026, at 14:00 UTC, addressing two critical vulnerabilities (CVSS 9.2 each) with potential remote code execution implications.

Even CERT-EU has issued a security advisory, recommending immediate patching once fixes become available.

Looking at recent PHP releases, Plesk has typically taken four days to provide updated packages:

PHP 8.4.23: July 2 → July 6
PHP 8.4.24: July 30 → August 3
PHP 8.4.26: September 24 → September 28

While this delay is understandable for regular releases, waiting several days for potentially critical RCE fixes could leave many production servers exposed.

Has Plesk already prepared for this emergency release? Is there an ETA for updated PHP packages, particularly PHP 8.4 on Linux?

Given the severity and potential impact, a same-day release would be highly appreciated.

brother4 · 2026-10-20T18:53:13-0700

More details:

https://twitter.com/x/status/2112705652208325061

rhall · 2026-10-20T22:21:05-0700

Just came here to post and ask about the same thing.

Quick tips based on what I have uncovered so far (and also covered in the link in the post above), to help mitigate if you must stay online:

Disable file uploads:
file_uploads = Off
and disable session.upload_progress.enabled by setting it to Off
session.upload_progress.enabled = Off

Also check your main php.ini and virtual hosts for any usage of auto_prepend_file if thats populated with anything.

Do this for your main php.ini and any individual virtual hosts that might be overriding it. Make sure you recycle PHP, Plesk, Apache, Nginx, etc.

If you haven't locked down your admin page and access port, to restrict it to only a static IP you can access, now is the time! And I don't mean the built in "IP Access Restriction Management" I mean do it at the firewall level, iptables, etc. whatever mechanism is on your server.

I am fortunate I am in a position to totally suspend and disable ALL my sites, domains, subdomains and aliases and fully disable PHP for each one until the full details are released at 10amEST tomorrow in case there are other mechanisms or methods to exploit beyond whats surfaced so far...

If you do disable PHP, check and see if you have any PHP processes running as children of the master instance for apache and nginx, if there are - it's not fully disabled. I disabled all of them and then killed the master process - going overboard to ensure I don't get hit. YMMV.

Things are gonna get ugly before they get better as it already making the rounds...

rhall · 2026-10-20T22:34:41-0700

Missed my edit window for the above, but an important detail: Even those mitigation steps may not be enough as it is also already circulating that apparently there is NO FIX unless a true patch is deployed. I'll be keeping my sites and PHP totally disabled until the additional details are released.

Harm Jakob Tolsma · 2026-10-20T22:51:04-0700

Disabling all domains absolutely seems like the safest option if you can afford to do so.

Sebahat.hadzhi · 2026-10-20T23:25:15-0700

Hi, everyone. According to PHP, the fix release is scheduled for today at 14:00 UTC. Once the vendor releases fixed versions, they will be included in Plesk PHP packages and delivered to Plesk servers. I cannot provide a precise ETA as of the moment. I will follow up with more details along the process.

danami · 2026-10-20T23:33:38-0700

Here is a bash script which should turn set `session.upload_progress.enabled = Off` for all PHP versions on the server. It needs to be run as root.

Code:

#!/bin/bash

# Define array of potential OS php.ini locations (Debian/Ubuntu vs RHEL/AlmaLinux/Rocky)
OS_INIS=(
    "/etc/php.ini"
    "/etc/php/*/cli/php.ini"
    "/etc/php/*/apache2/php.ini"
    "/etc/php/*/fpm/php.ini"
)

# 1. Update Plesk PHP versions
for ini in /opt/plesk/php/*/etc/php.ini; do
    if [ -f "$ini" ]; then
        if grep -q "session.upload_progress.enabled" "$ini"; then
            sed -i 's/^;\?\s*session.upload_progress.enabled\s*=.*/session.upload_progress.enabled = Off/' "$ini"
        else
            echo "session.upload_progress.enabled = Off" >> "$ini"
        fi
        echo "Updated Plesk PHP: $ini"
    fi
done

# 2. Update OS system PHP versions
for pattern in "${OS_INIS[@]}"; do
    for ini in $pattern; do
        if [ -f "$ini" ]; then
            if grep -q "session.upload_progress.enabled" "$ini"; then
                sed -i 's/^;\?\s*session.upload_progress.enabled\s*=.*/session.upload_progress.enabled = Off/' "$ini"
            else
                echo "session.upload_progress.enabled = Off" >> "$ini"
            fi
            echo "Updated OS PHP: $ini"
        fi
    done
done

# 3. Restart PHP-FPM services
echo "Restarting PHP-FPM services..."
systemctl restart 'plesk-php*-fpm' 2>/dev/null
systemctl restart php*-fpm 2>/dev/null
systemctl restart apache2 2>/dev/null || systemctl restart httpd 2>/dev/null

echo "Mitigation applied successfully!"

danami · 2026-10-20T23:48:43-0700

You should note that updating PHP might be the only TRUE fix. We won't know until they release the details.

HHawk · 2026-10-21T00:42:52-0700

Details are already known, probably it will be abused within the next hour... So Plesk/PHP needs to resolve this asap: Only for the curious...

danami · 2026-10-21T00:49:53-0700

Here is the updated script which should also set it for the Plesk panel itself:

Code:

#!/bin/bash

# Define array of system and Plesk Panel php.ini locations
SYSTEM_INIS=(
    "/usr/local/psa/admin/conf/php.ini"  # Plesk Panel itself
    "/etc/php.ini"                         # RHEL/AlmaLinux/Rocky OS PHP
    "/etc/php/*/cli/php.ini"               # Debian/Ubuntu CLI PHP
    "/etc/php/*/apache2/php.ini"           # Debian/Ubuntu Apache PHP
    "/etc/php/*/fpm/php.ini"               # Debian/Ubuntu FPM PHP
)

# Function to update or append directive
apply_setting() {
    local ini="$1"
    if grep -q "session.upload_progress.enabled" "$ini"; then
        sed -i 's/^;\?\s*session.upload_progress.enabled\s*=.*/session.upload_progress.enabled = Off/' "$ini"
    else
        echo "session.upload_progress.enabled = Off" >> "$ini"
    fi
    echo "Updated: $ini"
}

echo "=== 1. Updating Plesk Web Handlers ==="
for ini in /opt/plesk/php/*/etc/php.ini; do
    if [ -f "$ini" ]; then
        apply_setting "$ini"
    fi
done

echo "=== 2. Updating OS PHP & Plesk Panel ==="
for pattern in "${SYSTEM_INIS[@]}"; do
    for ini in $pattern; do
        if [ -f "$ini" ]; then
            apply_setting "$ini"
        fi
    done
done

echo "=== 3. Restarting Services ==="
# Restart Plesk PHP-FPM handlers
systemctl restart 'plesk-php*-fpm' 2>/dev/null

# Restart OS PHP-FPM / Web server
systemctl restart php*-fpm 2>/dev/null
systemctl restart apache2 2>/dev/null || systemctl restart httpd 2>/dev/null

# Restart Plesk Panel Engine (sw-engine)
systemctl restart sw-engine 2>/dev/null || service sw-engine restart 2>/dev/null

echo "Mitigation applied across all PHP environments!"

Test with:

Code:

grep -ri "session.upload_progress.enabled" /opt/plesk/php/*/etc/php.ini /etc/php* /usr/local/psa/admin/conf/php.ini 2>/dev/null

I'm thinking that updating PHP would probably only be the true fix however. That includes all the PHP installs on the server and the PHP that's used by the Plesk panel itself.

Mehl · 2026-10-21T01:21:52-0700

thanks @danami for the script.
beeing lazy, I asked Claude to improve the script.
* make a backup of the modified files
* reload instead of rettart

Code:

#!/bin/bash
set -u
TS=$(date +%Y%m%d-%H%M%S)

apply_setting() {
    local ini="$1"
    cp -a "$ini" "$ini.bak-$TS"
    if grep -qE '^\s*;?\s*session\.upload_progress\.enabled\s*=' "$ini"; then
        sed -i -E 's/^\s*;?\s*session\.upload_progress\.enabled\s*=.*/session.upload_progress.enabled = Off/' "$ini"
    else
        printf '\nsession.upload_progress.enabled = Off\n' >> "$ini"
    fi
    if grep -qE '^session\.upload_progress\.enabled = Off' "$ini"; then
        echo "OK:     $ini"
    else
        echo "FAILED: $ini" >&2
    fi
}

shopt -s nullglob
for ini in /opt/plesk/php/*/etc/php.ini \
           /usr/local/psa/admin/conf/php.ini \
           /etc/php.ini /etc/php/*/{cli,apache2,fpm}/php.ini; do
    [ -f "$ini" ] && apply_setting "$ini"
done

echo "=== Reloading services ==="
for unit in $(systemctl list-units --type=service --no-legend 'plesk-php*-fpm*' 'php*-fpm*' | awk '{print $1}'); do
    systemctl reload "$unit" && echo "reloaded $unit" || echo "RELOAD FAILED: $unit" >&2
done
systemctl reload apache2 2>/dev/null || systemctl reload httpd 2>/dev/null
systemctl restart sw-engine && echo "restarted sw-engine"

After running it
Verify on a live site. Put a temporary info.php containing <?php phpinfo(); on one domain per PHP version. Check that session.upload_progress.enabled shows Off under both “Local Value” and “Master Value”, then delete the file. This is the only reliable check, because the CLI doesn’t tell you what PHP-FPM actually loaded.
Add a WAF rule if you use ModSecurity in Plesk. This blocks the upload-progress field before it reaches PHP:

Code:

SecRule ARGS_POST_NAMES "@streq PHP_SESSION_UPLOAD_PROGRESS" "id:1026109618,phase:2,deny,status:403,log,msg:'PHP upload progress field (CVE-2026-109618/109619)'"

Restore:
if the upcoming PHP update has touched the files since you ran the script, you can restore the .bak copies:

Code:

for bak in /opt/plesk/php/*/etc/php.ini.bak-* /usr/local/psa/admin/conf/php.ini.bak-* /etc/php.ini.bak-* /etc/php/*/*/php.ini.bak-*; do
    [ -f "$bak" ] && cp -a "$bak" "${bak%.bak-*}" && echo "Restored ${bak%.bak-*}"
done

since I don't know if the update will change php.ini files, this might not work.
also: Remove the ModSecurity rule after this.

Linulex · 2026-10-21T01:36:53-0700

Will Plesk backport the patches to the older versions distributed by Plesk, or only the current versions?

I know those versions there are outdated and its better to upgrade, but if Plesk makes them available so its a bit Plesk's responsibility to make them as safe as possible.

Regards
Jan

aFrI · 2026-10-21T01:50:09-0700

@Linulex I would believe they can and will just take the upstream fixes - and even those details of which versions get fixes is unclear at the moment. to quote the official PHP statement:

Full details, affected versions, and the fixed versions will be published with the release.

Linulex said:
if Plesk makes them available so its a bit Plesk's responsibility to make them as safe as possible.

I would believe any admin is responsible for his own instance / server. Don't get me wrong here please, but I would strongly recommend to rethink your responsibility. Any backporting is appreciated for sure, but I would recommend to read the following list of which PHP versions may be considered deprecated already: PHP: Unsupported Branches

Hangover2 · 2026-10-21T02:00:09-0700

The scripts will not work, if you are using the Dedicated FPM application as PHP handler.
In this case you need to add the rule under e.g. /opt/plesk/php/[...]/etc/php.d/99-global-custom.ini with the content session.upload_progress.enabled = Off + reload all dedicated PHP handlers.

danami · 2026-10-21T02:10:32-0700

@Hangover2 is right. Here is the script updated to handle Dedicated FPM applications too:

Code:

#!/bin/bash

SETTING="session.upload_progress.enabled = Off"

# Define array of system and Plesk Panel php.ini locations
SYSTEM_INIS=(
    "/usr/local/psa/admin/conf/php.ini"  # Plesk Panel itself
    "/etc/php.ini"                         # RHEL/AlmaLinux/Rocky OS PHP
    "/etc/php/*/cli/php.ini"               # Debian/Ubuntu CLI PHP
    "/etc/php/*/apache2/php.ini"           # Debian/Ubuntu Apache PHP
    "/etc/php/*/fpm/php.ini"               # Debian/Ubuntu FPM PHP
)

# Function to update or append directive in standard php.ini files
apply_setting() {
    local ini="$1"
    if grep -q "session.upload_progress.enabled" "$ini"; then
        sed -i 's/^;\?\s*session.upload_progress.enabled\s*=.*/session.upload_progress.enabled = Off/' "$ini"
    else
        echo "$SETTING" >> "$ini"
    fi
    echo "Updated: $ini"
}

echo "=== 1. Updating Plesk Web Handlers ==="
for ini in /opt/plesk/php/*/etc/php.ini; do
    if [ -f "$ini" ]; then
        apply_setting "$ini"
    fi
done

echo "=== 2. Adding Dedicated FPM override (.d/99-global-custom.ini) ==="
for php_dir in /opt/plesk/php/*; do
    if [ -d "$php_dir/etc/php.d" ]; then
        custom_ini="$php_dir/etc/php.d/99-global-custom.ini"
        echo "$SETTING" > "$custom_ini"
        echo "Created/Updated: $custom_ini"
    fi
done

echo "=== 3. Updating OS PHP & Plesk Panel ==="
for pattern in "${SYSTEM_INIS[@]}"; do
    for ini in $pattern; do
        if [ -f "$ini" ]; then
            apply_setting "$ini"
        fi
    done
done

echo "=== 4. Restarting Services ==="
# Restart Plesk PHP-FPM handlers (including dedicated pools)
systemctl restart 'plesk-php*-fpm' 2>/dev/null

# Restart OS PHP-FPM / Web server
systemctl restart php*-fpm 2>/dev/null
systemctl restart apache2 2>/dev/null || systemctl restart httpd 2>/dev/null

# Restart Plesk Panel Engine (sw-engine)
systemctl restart sw-engine 2>/dev/null || service sw-engine restart 2>/dev/null

echo "Mitigation applied completely across all Plesk handlers, dedicated FPM pools, system PHP, and the control panel!"

Mehl · 2026-10-21T02:22:53-0700

@Hangover2 you're right, I missed that.

here is a updated version handling this via a "99-global-custom.ini" in all installed "opt/plesk/php/*/etc/php.d/" directories.
it should also handle plesks own php.
This is all annoying ... I really hope the fix will be delivered fast.
note: I am not sure if this will really help 100% - just gathered information that is available from the web....

save as "plesk-php2shell-mitigation.sh"

Code:

#!/bin/bash
# Interim mitigation for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) on Plesk servers.
# Disables session.upload_progress for all PHP handlers:
#   FastCGI / FPM / Dedicated FPM (Apache or nginx), Plesk PHP and OS-vendor PHP.
#
# NOTE: Unconfirmed, partial mitigation. It does NOT replace the PHP update.
#
# Usage:
#   sudo ./plesk-php2shell-mitigation.sh            # apply
#   sudo ./plesk-php2shell-mitigation.sh rollback   # undo after patching

set -u
shopt -s nullglob

MODE="${1:-apply}"
DROPIN_NAME="99-global-custom.ini"
DIRECTIVE="session.upload_progress.enabled = Off"
PANEL_INI="/usr/local/psa/admin/conf/php.ini"
TS=$(date +%Y%m%d-%H%M%S)

if [ "$(id -u)" -ne 0 ]; then
    echo "Please run as root." >&2
    exit 1
fi

# php.d / conf.d directories for every PHP the server may use
DROPIN_DIRS=(
    /opt/plesk/php/*/etc/php.d          # Plesk PHP (all handlers)
    /etc/php.d                          # OS vendor PHP (RHEL/Alma/Rocky)
    /etc/php/*/fpm/conf.d               # OS vendor PHP (Debian/Ubuntu) FPM
    /etc/php/*/cgi/conf.d               # OS vendor PHP (Debian/Ubuntu) FastCGI
    /etc/php/*/apache2/conf.d           # OS vendor PHP (Debian/Ubuntu) mod_php
    /etc/php/*/cli/conf.d               # OS vendor PHP (Debian/Ubuntu) CLI
)

apply() {
    echo "=== 1. Writing drop-in files ==="
    for d in "${DROPIN_DIRS[@]}"; do
        [ -d "$d" ] || continue
        printf '; PHP2Shell interim mitigation (%s) - remove after patching\n%s\n' "$TS" "$DIRECTIVE" > "$d/$DROPIN_NAME"
        echo "Written: $d/$DROPIN_NAME"
    done

    echo "=== 2. Plesk panel (sw-engine) ==="
    if [ -f "$PANEL_INI" ]; then
        cp -a "$PANEL_INI" "$PANEL_INI.bak-$TS"
        if grep -qE '^\s*;?\s*session\.upload_progress\.enabled\s*=' "$PANEL_INI"; then
            sed -i -E 's/^\s*;?\s*session\.upload_progress\.enabled\s*=.*/session.upload_progress.enabled = Off/' "$PANEL_INI"
        else
            printf '\n%s\n' "$DIRECTIVE" >> "$PANEL_INI"
        fi
        grep -qE '^session\.upload_progress\.enabled = Off' "$PANEL_INI" \
            && echo "OK:     $PANEL_INI (backup: $PANEL_INI.bak-$TS)" \
            || echo "FAILED: $PANEL_INI" >&2
    fi
}

rollback() {
    echo "=== 1. Removing drop-in files ==="
    for d in "${DROPIN_DIRS[@]}"; do
        if [ -f "$d/$DROPIN_NAME" ] && grep -q 'PHP2Shell interim mitigation' "$d/$DROPIN_NAME"; then
            rm -f "$d/$DROPIN_NAME"
            echo "Removed: $d/$DROPIN_NAME"
        fi
    done

    echo "=== 2. Plesk panel (sw-engine) ==="
    if [ -f "$PANEL_INI" ] && grep -qE '^session\.upload_progress\.enabled = Off' "$PANEL_INI"; then
        sed -i -E 's/^session\.upload_progress\.enabled = Off/session.upload_progress.enabled = On/' "$PANEL_INI"
        echo "Reverted: $PANEL_INI"
    fi
}

reload_services() {
    echo "=== 3. Reloading PHP-FPM (shared + dedicated, Plesk + OS vendor) ==="
    for unit in $(systemctl list-units --type=service --state=running --no-legend --plain \
                  'plesk-php*-fpm*' 'php*-fpm*' | awk '{print $1}'); do
        systemctl reload "$unit" && echo "reloaded  $unit" || echo "RELOAD FAILED: $unit" >&2
    done

    echo "=== 4. Restarting Apache (required for FastCGI handlers) ==="
    if systemctl is-active --quiet httpd; then
        systemctl restart httpd && echo "restarted httpd" || echo "RESTART FAILED: httpd" >&2
    elif systemctl is-active --quiet apache2; then
        systemctl restart apache2 && echo "restarted apache2" || echo "RESTART FAILED: apache2" >&2
    fi

    echo "=== 5. Restarting Plesk panel (sw-engine) ==="
    systemctl restart sw-engine && echo "restarted sw-engine" || echo "RESTART FAILED: sw-engine" >&2
}

verify() {
    echo "=== 6. Verification (CLI view of each PHP version) ==="
    for bin in /opt/plesk/php/*/bin/php /usr/bin/php; do
        [ -x "$bin" ] || continue
        state=$("$bin" -r 'echo ini_get("session.upload_progress.enabled") ? "On" : "Off";' 2>/dev/null)
        echo "$bin: session.upload_progress.enabled = ${state:-unknown}"
    done
    echo
    echo "Final check: open a temporary phpinfo() page on one domain per handler type"
    echo "and confirm the value under 'Local Value' and 'Master Value'. Delete it afterwards."
}

case "$MODE" in
    apply)    apply;    reload_services; verify ;;
    rollback) rollback; reload_services; verify ;;
    *)        echo "Usage: $0 [apply|rollback]" >&2; exit 1 ;;
esac

Code:

sudo ./plesk-php2shell-mitigation.sh            # apply mitigation
sudo ./plesk-php2shell-mitigation.sh rollback   # rollback after php was updated

Kaspar · 2026-10-21T02:29:18-0700

I think this:

danami said:

Should be:

Code:

echo "=== 4. Restarting Services ==="
# Restart Plesk PHP-FPM handlers (including dedicated pools)
systemctl restart 'plesk-php*-fpm*' 2>/dev/null

Adding the wildcard asterix after the -fpm* portion to actually restart the dedicated PHP handlers.

HHawk · 2026-10-21T02:33:54-0700

Seems pointless in regards to: session.upload_progress.enabled = off
Says someone at PHP themselves: Gina Peter Banyard (@[email protected])

Lucas K. · 2026-10-21T03:10:27-0700

Enhance 12.26.1 and PHP CVE-2026-109618 or CVE-2026-109619 - Enhance Control Panel - Community

Our forum offers a space to ask and answer questions, share technical advice and help guide the direction of Enhance.

community.enhance.com

Why isn't Plesk organized very well?

HHawk · 2026-10-21T03:18:29-0700

Lucas K. said:
Enhance 12.26.1 and PHP CVE-2026-109618 or CVE-2026-109619 - Enhance Control Panel - Community

Our forum offers a space to ask and answer questions, share technical advice and help guide the direction of Enhance.

community.enhance.com

Why isn't Plesk organized very well?

Probably we aren't paying enough for this kind of service?
I guess they will have to increase Plesk license prices again before we get this kind of excellent service.

Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

Basic Pleskian

Basic Pleskian

New Pleskian

New Pleskian

New Pleskian

Community Manager

Silver Pleskian

Silver Pleskian

Regular Pleskian

Silver Pleskian

New Pleskian

Silver Pleskian

New Pleskian

Regular Pleskian

Silver Pleskian

New Pleskian

API expert

Regular Pleskian

New Pleskian

Regular Pleskian

Similar threads