Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[Goose]

Thanks, the plesk installer update in CLI have made the necessary update for my websites.

Still, as reported:

However, the PHP used by the Plesk panel itself (sw-engine) has not been updated yet.

Same for me.

 

[Sebahat.hadzhi]

Only tracking or compiling/backporting?

All I know is they are working on providing backported fixes for the versions they support. However, as they are a third-party service, I have no internal information on what exactly is being done on their end.

I'm sorry i don't understand. For older versions (7.4 to 8.1), even on Plesk linux, are these builds/releases in progress ? Do you know when we are going to be able to update ?

Yes, they are in progress. The builds are complete and they are in testing phase. They should be released soon if everything goes well.

 

[George Labro]

For anyone interested, this is what I implemented until an update for sw-engine exists. I suggest to either enable a Firewall rule to allow access to port 8443 only from known IPs and/or use an SSH tunnel to access the admin panel.

 

[manni]

@Sebahat.hadzhi
The fix for old PHP releases will be done by TuxCare - but do I need the ELS for CentOS license or the ELS for PHP license then ?

 

[Linulex]

All I know is they are working on providing backported fixes for the versions they support. However, as they are a third-party service, I have no internal information on what exactly is being done on their end.



Yes, they are in progress. The builds are complete and they are in testing phase. They should be released soon if everything goes well.

Will these be available via the plesk repositry? Plesk makes them available and i have installed these PHP versions via Plesk so i believe Plesk should provide the updates.

If Plesk doesn't make them available and they stay in the repositry then they will knowingly and willingly distribute unsafe versions.

Regards
Jan

 

[filipe.carreira]

What's the status for the Windows builds: Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk
And will the builds for EOL will backported or not?
You info the on article above that you would backport those versions but it has since been removed.

 

[Christian D]

Hello,

I have four servers running Ubuntu 24.04 with Plesk, but none of them is offering me the update.
What can I do to resolve this issue?
Thank you very much for your help.

Best regards

 

[brother4]

There will be a hotfix for sw-engine today. Please read before you post!

If you want to take some precautions until then, you should check this out (I've already done it):

Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk

SituationTwo security vulnerabilities were discovered in PHP. As a result, all PHP versions shipped with Plesk are also affected. These security vulnerabilities have been identified as CVE-2026-109...

support.plesk.com

systemctl stop sw-cp-server

 

[brother4]

Hello,

I have four servers running Ubuntu 24.04 with Plesk, but none of them is offering me the update.
What can I do to resolve this issue?
Thank you very much for your help.

Best regards

Question - ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

Use the cli: plesk installer update apt clean all apt update apt upgrade Perfect this works thanks!!

talk.plesk.com

plesk installer --select-release-current --upgrade-installed-components

 

[Flashdown]

Hi there,

what about Roundcube? When will it's PHP version be updated as it uses it's own PHP Version AFAIR, that's why webmail is currently disabled over here.

 

[manni]

Any idea how to Test?

 

[iForced]

@Sebahat.hadzhi As you do respond here.. what about Windows ? Issue - critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)

 

[brother4]

Any idea how to Test?

for php in /opt/plesk/php/*/bin/php; do [ -x "$php" ] || continue; "$php" -r '$fix=["8.2"=>"8.2.35","8.3"=>"8.3.36","8.4"=>"8.4.27","8.5"=>"8.5.12"]; $v=PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION; printf("PHP %s: %s\n",PHP_VERSION,isset($fix[$v])?(version_compare(PHP_VERSION,$fix[$v],">=")?"PATCHED":"VULNERABLE"):"LEGACY - CHECK VENDOR PATCH");'; done

PHP 8.3.36: PATCHED
PHP 8.4.27: PATCHED
PHP 8.5.12: PATCHED

 

[Christian D]

Question - ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

Use the cli: plesk installer update apt clean all apt update apt upgrade Perfect this works thanks!!

talk.plesk.com

plesk installer --select-release-current --upgrade-installed-components

Unfortunately not :-(

 

[brother4]

Hi there,

what about Roundcube? When will it's PHP version be updated as it uses it's own PHP Version AFAIR, that's why webmail is currently disabled over here.

/opt/plesk/php/8.3/bin/php-cgi -v

This is the version that Roundcube uses - you should have the patch for Linux

 

[acordero]

Hi.
ETA for 7.4,8.0 and 8.1 version?
Thanks

 

[brother4]

Unfortunately not :-(

Restart server and check again for updates

 

[Sebahat.hadzhi]

The hotfix (sw-engine update) for Plesk Obsidian 18.0.81 and Windows builds are scheduled for publishing so you can expect them soon. Hotfix for Plesk Obsidian18.0.80 and backports for PHP 7.4 - 8.1 are still in progress. They are all in testing phase, but I cannot confirm when exactly they are going to be published. Thank you all for your patience and understanding.

 

[Flashdown]

/opt/plesk/php/8.3/bin/php-cgi -v

This is the version that Roundcube uses - you should have the patch for Linux

thx, confirmed it, so I had that wrong remembered that it ships with a own version, was a missinterpretation from me then. thx for the clarification