Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[brother4]

Thanks for the quick update! If anyone else had trouble updating via SSH:

Fix for Plesk PHP updates failing with NO_PUBKEY ...

1. Download and inspect the Plesk GPG key:

curl -fsSL https://autoinstall.plesk.com/plesk.gpg -o /tmp/plesk-key.asc && gpg --show-keys --with-fingerprint /tmp/plesk-key.asc

2. Back up the existing keyring, add the new key, and refresh package lists:

cp -a /etc/apt/keyrings/plesk.gpg /etc/apt/keyrings/plesk.gpg.bak && gpg --dearmor < /tmp/plesk-key.asc >> /etc/apt/keyrings/plesk.gpg && apt update

3. Install available updates:

apt upgrade

4. Verify the installed PHP 8.4 version:

apt policy plesk-php84-fpm && /opt/plesk/php/8.4/bin/php -v

The patched PHP version is 8.4.27. Plesk also provides patched versions 8.2.35, 8.3.36 and 8.5.12.

This resolved the GPG signature error on my Plesk Obsidian server running Ubuntu 24.04.

 

[Linulex]

Hi, everyone. PHP 8.2-8.5 updates for Linux have been published. The rest of the builds are still in progress.

Are the rest of the builds the windows versions or also 7.4, 8.0 and 8.1?

PHP

PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.

www.php.net

Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people

Regards
Jan

 

[sashman13]

So, this updated 8.2 and 8.3 for me, but sw-engine is still using 8.4.24 and 8.4.25. It didn't update these.

 

[Hangover2]

DEB.SURY.ORG did also release patched versions already. Made my day^^

 

[Bitpalast]

In some cases, users won't see the update on their GUI. If that applies to you, reader of this post, run plesk installer update on the console instead, and it will update.

 

[Bitpalast]

So, this updated 8.2 and 8.3 for me, but sw-engine is still using 8.4.24 and 8.4.25. It didn't update these.

They'll probably fix that later. There is urgency for that, cause there is attack surface against the internal webserver, e.g. an "upload progress" bar or similar.
Edit: Fixed in the nightly update that was just published. It's now using 8.4.27.

 

[pleskpanel]

The big concern that we have at the moment is that the Plesk PHP sw-engine engine isn't getting updated just yet.

 

[brother4]

FYI If anyone has something similar (I kept getting that for minutes):

plesk installer update
BUSY: Update operation was locked by another update process.
exit status 1
plesk installer stop
Requested Plesk Installer shutdown.
plesk installer update

After that, this approach worked, too.

 

[Sebahat.hadzhi]

@Linulex for Plesk for Windows. The updates for older PHP versions should be shipped by Tuxcare - they are already tracking the case.

@sashman13 , our team is already working on a hotfix for sw-engine that will be released for Plesk Obsidian 18.0.80 and 18.0.81. The target for the release is today, but I cannot provide a firm ETA.

​

 

[nethubonline]

@Sebahat.hadzhi

Thanks for the quick PHP updates. The plesk-phpXX packages on our servers are now on the fixed versions (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12).

However, the PHP used by the Plesk panel itself (sw-engine) has not been updated yet. On our servers it is still:

sw-engine -v
PHP 8.4.25 (cli) (built: Sep 2 2026 08:43:04) (NTS)

rpm -q sw-engine
sw-engine-8.81.0-0redhat.10.260903.0901.x86_64

As 8.4.25 is below the fixed 8.4.27, could you please advise: when will an updated sw-engine package be released?

Thank you.

 

[andyxyz]

amazing job getting these all out so quickly!! thanks to all the team

 

[Sebahat.hadzhi]

The updates for older PHP versions should be shipped by Tuxcare - they are already tracking the case.

That's not entirely accurate. Apologies for any possible confusion caused. Our team will backport the fixes for PHP 7.4 - 8.1 as well. Patches for versions older than that should be expected by Tuxcare.

 

[Vince]

@Linulex for Plesk for Windows. The updates for older PHP versions should be shipped by Tuxcare - they are already tracking the case.

@sashman13 , our team is already working on a hotfix for sw-engine that will be released for Plesk Obsidian 18.0.80 and 18.0.81. The target for the release is today, but I cannot provide a firm ETA.

​

I'm sorry i don't understand. For older versions (7.4 to 8.1), even on Plesk linux, are these builds/releases in progress ? Do you know when we are going to be able to update ?

(For 8.2 to 8.5 it already worked like a charm)

 

[Goose]

Thanks, the plesk installer update in CLI have made the necessary update for my websites.

Still, as reported:

However, the PHP used by the Plesk panel itself (sw-engine) has not been updated yet.

Same for me.

 

[Sebahat.hadzhi]

Only tracking or compiling/backporting?

All I know is they are working on providing backported fixes for the versions they support. However, as they are a third-party service, I have no internal information on what exactly is being done on their end.

I'm sorry i don't understand. For older versions (7.4 to 8.1), even on Plesk linux, are these builds/releases in progress ? Do you know when we are going to be able to update ?

Yes, they are in progress. The builds are complete and they are in testing phase. They should be released soon if everything goes well.

 

[George Labro]

For anyone interested, this is what I implemented until an update for sw-engine exists. I suggest to either enable a Firewall rule to allow access to port 8443 only from known IPs and/or use an SSH tunnel to access the admin panel.

 

[manni]

@Sebahat.hadzhi
The fix for old PHP releases will be done by TuxCare - but do I need the ELS for CentOS license or the ELS for PHP license then ?

 

[Linulex]

All I know is they are working on providing backported fixes for the versions they support. However, as they are a third-party service, I have no internal information on what exactly is being done on their end.



Yes, they are in progress. The builds are complete and they are in testing phase. They should be released soon if everything goes well.

Will these be available via the plesk repositry? Plesk makes them available and i have installed these PHP versions via Plesk so i believe Plesk should provide the updates.

If Plesk doesn't make them available and they stay in the repositry then they will knowingly and willingly distribute unsafe versions.

Regards
Jan

 

[filipe.carreira]

What's the status for the Windows builds: Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk
And will the builds for EOL will backported or not?
You info the on article above that you would backport those versions but it has since been removed.

 

[Christian D]

Hello,

I have four servers running Ubuntu 24.04 with Plesk, but none of them is offering me the update.
What can I do to resolve this issue?
Thank you very much for your help.

Best regards