Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[brother4]

There will be a hotfix for sw-engine today. Please read before you post!

If you want to take some precautions until then, you should check this out (I've already done it):

Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk

SituationTwo security vulnerabilities were discovered in PHP. As a result, all PHP versions shipped with Plesk are also affected. These security vulnerabilities have been identified as CVE-2026-109...

support.plesk.com

systemctl stop sw-cp-server

 

[brother4]

Hello,

I have four servers running Ubuntu 24.04 with Plesk, but none of them is offering me the update.
What can I do to resolve this issue?
Thank you very much for your help.

Best regards

Question - ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

Use the cli: plesk installer update apt clean all apt update apt upgrade Perfect this works thanks!!

talk.plesk.com

plesk installer --select-release-current --upgrade-installed-components

 

[Flashdown]

Hi there,

what about Roundcube? When will it's PHP version be updated as it uses it's own PHP Version AFAIR, that's why webmail is currently disabled over here.

 

[manni]

Any idea how to Test?

 

[iForced]

@Sebahat.hadzhi As you do respond here.. what about Windows ? Issue - critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)

 

[brother4]

Any idea how to Test?

for php in /opt/plesk/php/*/bin/php; do [ -x "$php" ] || continue; "$php" -r '$fix=["8.2"=>"8.2.35","8.3"=>"8.3.36","8.4"=>"8.4.27","8.5"=>"8.5.12"]; $v=PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION; printf("PHP %s: %s\n",PHP_VERSION,isset($fix[$v])?(version_compare(PHP_VERSION,$fix[$v],">=")?"PATCHED":"VULNERABLE"):"LEGACY - CHECK VENDOR PATCH");'; done

PHP 8.3.36: PATCHED
PHP 8.4.27: PATCHED
PHP 8.5.12: PATCHED

 

[Christian D]

Question - ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

Use the cli: plesk installer update apt clean all apt update apt upgrade Perfect this works thanks!!

talk.plesk.com

plesk installer --select-release-current --upgrade-installed-components

Unfortunately not :-(

 

[brother4]

Hi there,

what about Roundcube? When will it's PHP version be updated as it uses it's own PHP Version AFAIR, that's why webmail is currently disabled over here.

/opt/plesk/php/8.3/bin/php-cgi -v

This is the version that Roundcube uses - you should have the patch for Linux

 

[acordero]

Hi.
ETA for 7.4,8.0 and 8.1 version?
Thanks

 

[brother4]

Unfortunately not :-(

Restart server and check again for updates

 

[Sebahat.hadzhi]

The hotfix (sw-engine update) for Plesk Obsidian 18.0.81 and Windows builds are scheduled for publishing so you can expect them soon. Hotfix for Plesk Obsidian18.0.80 and backports for PHP 7.4 - 8.1 are still in progress. They are all in testing phase, but I cannot confirm when exactly they are going to be published. Thank you all for your patience and understanding.

 

[Flashdown]

/opt/plesk/php/8.3/bin/php-cgi -v

This is the version that Roundcube uses - you should have the patch for Linux

thx, confirmed it, so I had that wrong remembered that it ships with a own version, was a missinterpretation from me then. thx for the clarification

 

[TorbHo]

Updates for Plesk Linux PHP 7.4-8.1 are now available.

 

[nbejansen]

The PHP 7.4 and 8.0 versions are no longer available in the component selection. They are still installed on the server, but the updater doesn't pick up any updates. Does anybody know what could be wrong?

 

[pleskpanel]

Any word on the sw-engine update?

 

[Vince]

Updates for Plesk Linux PHP 7.4-8.1 are now available.

Wonderful, thx for the notification. Updates applied.

 

[Christian D]

Hello,
if anyone is not receiving updates and is hosting with STRATO, change the mirror URLs in plesk.list from the STRATO mirrors to autoinstall.plesk.com.

 

[nbejansen]

Are CloudLinux 9 builds for PHP 7.4 and 8.0 still pending?

 

[pleskpanel]

Yes, Plesk packages a seperate version of PHP for use with its own services. To date these have not been updated so while websites running on an updated Plesk server are no longer vulnerable, Plesk effectively still is until the version is updated.

If you run this and it comes back with PHP 8.4.25, then the Plesk panel itself becomes the attack vector:

/usr/local/psa/admin/bin/php -v

A release to address this as soon as possible would help to close that gap.

 

[TobiasP]

I have

service sw-cp-server stop

until a fix is released...