Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[Mehl]

Just now: RELEASED!

PHP: News Archive - 2026

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

www.php.net

sorry, that was an old article ... look at the start page!

PHP

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

www.php.net

 

[Mehl]

is plesk important enough to be included in:
"Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages."

 

[LKNessy]

Updates are available via the plesk updater.

Thanks for the fast reaction here Plesk.

 

[Sebahat.hadzhi]

Hi, everyone. PHP 8.2-8.5 updates for Linux have been published. The rest of the builds are still in progress.

 

[Mehl]

I have updated all 8.3, 8.4 and 8.5 ... Thanks Plesk for beiing so fast!

 

[Ladylinux]

Apt Update Bookworm. This is not helping

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP82_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP83_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP84_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96

 

[klowet]

I think Plesk update is down

Error: Unable to receive update information for the package(s)

With an apt-update (Debian), I get:

W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP82_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP83_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP84_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: Index of /PHP85_17 bookworm InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Failed to fetch http://autoinstall.plesk.com/PHP82_17/dists/bookworm/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Failed to fetch http://autoinstall.plesk.com/PHP83_17/dists/bookworm/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Failed to fetch http://autoinstall.plesk.com/PHP84_17/dists/bookworm/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Failed to fetch http://autoinstall.plesk.com/PHP85_17/dists/bookworm/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96
W: Some index files failed to download. They have been ignored, or old ones used instead.

 

[LKNessy]

Use the plesk updater/installer in the backend. Seems like apt-update is having some issues due to cache etc.

 

[klowet]

Same issue in Plesk admin:

 

[sneppa]

Thank you plesk for the fast reaction - all servers are updated (through the interface, apt-get had some issues)

 

[Tjerk Visser]

How long wil this update take? It seems to be hanging here as well.

 

[H.W.B]

I updated the server via components update. Everything is fine. No problems!!!

 

[LKNessy]

Did you try Tools & Settings -> Plesk -> Updates?

 

[Monty]

I think Plesk update is down


With an apt-update (Debian), I get:

Use the cli:

plesk installer update
apt clean all
apt update
apt upgrade

 

[George Labro]

I have upgraded Plesk's managed PHP versions but it seems that the Admin Panel's PHP has not been updated? Any ideas?

# /usr/local/psa/admin/bin/php -v
PHP 8.4.24 (cli) (built: Aug 27 2026 07:14:20) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.4.24, Copyright (c) Zend Technologies
with Zend OPcache v8.4.24, Copyright (c), by Zend Technologies

 

[Tjerk Visser]

Browser back button did the trick

 

[mike_tcis]

A core php developer posted that only patching will solve the problem.

Gina Peter Banyard (@[email protected])

@[email protected] The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.

phpc.social

This fix works prior to PHP being invoked, so it will work. But it breaks a lot of other things, but is better than getting compromised.

 

[Ladylinux]

Use the cli:

plesk installer update
apt clean all
apt update
apt upgrade

Perfect this works thanks!!

 

[Harm Jakob Tolsma]

This fix works prior to PHP being invoked, so it will work. But it breaks a lot of other things, but is better than getting compromised.

True, but I'm just happy the patches dropped and installed like a charm.

 

[gerardbolhuis]

Please give the release numbers after update