Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[Ladylinux]

Use the cli:

plesk installer update
apt clean all
apt update
apt upgrade

Perfect this works thanks!!

 

[HHawk]

I have updated all 8.3, 8.4 and 8.5 ... Thanks Plesk for beiing so fast!

Plesk will increase next years pricing by 500% :-D

 

[Harm Jakob Tolsma]

This fix works prior to PHP being invoked, so it will work. But it breaks a lot of other things, but is better than getting compromised.

True, but I'm just happy the patches dropped and installed like a charm.

 

[gerardbolhuis]

Please give the release numbers after update

 

[brother4]

Thanks for the quick update! If anyone else had trouble updating via SSH:

Fix for Plesk PHP updates failing with NO_PUBKEY ...

1. Download and inspect the Plesk GPG key:

curl -fsSL https://autoinstall.plesk.com/plesk.gpg -o /tmp/plesk-key.asc && gpg --show-keys --with-fingerprint /tmp/plesk-key.asc

2. Back up the existing keyring, add the new key, and refresh package lists:

cp -a /etc/apt/keyrings/plesk.gpg /etc/apt/keyrings/plesk.gpg.bak && gpg --dearmor < /tmp/plesk-key.asc >> /etc/apt/keyrings/plesk.gpg && apt update

3. Install available updates:

apt upgrade

4. Verify the installed PHP 8.4 version:

apt policy plesk-php84-fpm && /opt/plesk/php/8.4/bin/php -v

The patched PHP version is 8.4.27. Plesk also provides patched versions 8.2.35, 8.3.36 and 8.5.12.

This resolved the GPG signature error on my Plesk Obsidian server running Ubuntu 24.04.

 

[Linulex]

Hi, everyone. PHP 8.2-8.5 updates for Linux have been published. The rest of the builds are still in progress.

Are the rest of the builds the windows versions or also 7.4, 8.0 and 8.1?

PHP

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

www.php.net

Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people

Regards
Jan

 

[sashman13]

So, this updated 8.2 and 8.3 for me, but sw-engine is still using 8.4.24 and 8.4.25. It didn't update these.

 

[Hangover2]

DEB.SURY.ORG did also release patched versions already. Made my day^^

 

[HHawk]

Are the rest of the builds the windows versions or also 7.4, 8.0 and 8.1?

PHP

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

www.php.net

Regards
Jan

Nope, nothing of those available yet....

 

[Bitpalast]

In some cases, users won't see the update on their GUI. If that applies to you, reader of this post, run plesk installer update on the console instead, and it will update.

 

[Bitpalast]

So, this updated 8.2 and 8.3 for me, but sw-engine is still using 8.4.24 and 8.4.25. It didn't update these.

They'll probably fix that later. There is urgency for that, cause there is attack surface against the internal webserver, e.g. an "upload progress" bar or similar.

 

[pleskpanel]

The big concern that we have at the moment is that the Plesk PHP sw-engine engine isn't getting updated just yet.

 

[brother4]

FYI If anyone has something similar (I kept getting that for minutes):

plesk installer update
BUSY: Update operation was locked by another update process.
exit status 1
plesk installer stop
Requested Plesk Installer shutdown.
plesk installer update

After that, this approach worked, too.

 

[Sebahat.hadzhi]

@Linulex for Plesk for Windows. The updates for older PHP versions should be shipped by Tuxcare - they are already tracking the case.

@sashman13 , our team is already working on a hotfix for sw-engine that will be released for Plesk Obsidian 18.0.80 and 18.0.81. The target for the release is today, but I cannot provide a firm ETA.

​

 

[nethubonline]

@Sebahat.hadzhi

Thanks for the quick PHP updates. The plesk-phpXX packages on our servers are now on the fixed versions (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12).

However, the PHP used by the Plesk panel itself (sw-engine) has not been updated yet. On our servers it is still:

sw-engine -v
PHP 8.4.25 (cli) (built: Sep 2 2026 08:43:04) (NTS)

rpm -q sw-engine
sw-engine-8.81.0-0redhat.10.260903.0901.x86_64

As 8.4.25 is below the fixed 8.4.27, could you please advise: when will an updated sw-engine package be released?

Thank you.

 

[HHawk]

@Linulex for Plesk for Windows. The updates for older PHP versions should be shipped by Tuxcare - they are already tracking the case.

Only tracking or compiling/backporting?

 

[andyxyz]

amazing job getting these all out so quickly!! thanks to all the team

 

[HHawk]

Wow great service at DirectAdmin! They are also going to provide fixed versions for older PHP-versions.

I quote fln (employee of DA):
PHP versions 7.3 - 5.6 does not yet have a patch, we wanted to release what we have as soon as possible. Once we have patches for older PHP we will release them.

That's excellent service from DirectAdmin! Only can hope that Plesk would follow this example!

 

[Sebahat.hadzhi]

The updates for older PHP versions should be shipped by Tuxcare - they are already tracking the case.

That's not entirely accurate. Apologies for any possible confusion caused. Our team will backport the fixes for PHP 7.4 - 8.1 as well. Patches for versions older than that should be expected by Tuxcare.

 

[Vince]

@Linulex for Plesk for Windows. The updates for older PHP versions should be shipped by Tuxcare - they are already tracking the case.

@sashman13 , our team is already working on a hotfix for sw-engine that will be released for Plesk Obsidian 18.0.80 and 18.0.81. The target for the release is today, but I cannot provide a firm ETA.

​

I'm sorry i don't understand. For older versions (7.4 to 8.1), even on Plesk linux, are these builds/releases in progress ? Do you know when we are going to be able to update ?

(For 8.2 to 8.5 it already worked like a charm)