Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[nbejansen]

The PHP 7.4 and 8.0 versions are no longer available in the component selection. They are still installed on the server, but the updater doesn't pick up any updates. Does anybody know what could be wrong?

 

[pleskpanel]

Any word on the sw-engine update?

 

[Vince]

Updates for Plesk Linux PHP 7.4-8.1 are now available.

Wonderful, thx for the notification. Updates applied.

 

[Christian D]

Hello,
if anyone is not receiving updates and is hosting with STRATO, change the mirror URLs in plesk.list from the STRATO mirrors to autoinstall.plesk.com.

 

[nbejansen]

Are CloudLinux 9 builds for PHP 7.4 and 8.0 still pending?

 

[HHawk]

sw-engine?

 

[pleskpanel]

Yes, Plesk packages a seperate version of PHP for use with its own services. To date these have not been updated so while websites running on an updated Plesk server are no longer vulnerable, Plesk effectively still is until the version is updated.

If you run this and it comes back with PHP 8.4.25, then the Plesk panel itself becomes the attack vector:

/usr/local/psa/admin/bin/php -v

A release to address this as soon as possible would help to close that gap.

 

[TobiasP]

I have

service sw-cp-server stop

until a fix is released...

 

[Lucas K.]

When will updates 18.0.80#11 and 18.0.81#4 finally be released? It can't be right that the most important update is still pending! Other panels have had this sorted out for a long time now; with just the PHP updates, only the customers' websites are secure—the main interface isn't yet!

 

[Lucas K.]

But hey, you guys are quick to raise prices—I guess that's about it, unfortunately. I hope this will be posted tonight.

 

[afuego]

Easy update; Go to Tools & Settings->Updates->Update Components.

To force Node.js updates and fix the vulnerabilities released today October 21:

plesk php -dauto_prepend_file=sdk.php '/opt/psa/admin/plib/modules/nodejs/scripts/nodejs-auto-update.php'

No updates will be released for PHP 8.1 or older.
No updates for end-of-life Node.js versions 27.3.1 or older

 

[Janko Falli]

@Sebahat.hadzhi any ETA on 18.0.81#4 hours passed....

 

[pleskuser67553]

Hello, I used the GUI update in Tools & Settings > Updates, it brought down the new patch versions for PHP 8 with changed version numbers, and also patches for 7.4.33, I understand that its version number does not change, but can you confirm, am I looking at the patched version? It would be super helpful if that article actually showed the build numbers, if possible..?

plesk-php74 7.4.33-1centos.7.261021.1344 (PLESK_17_PHP74)

 

[HHawk]

Why can DirectAdmin update/patch everything within 3 hours, where Plesk takes many more hours???

Even DirectAdmin even patched PHP versions from 5.4 to 8.5! Without the use of expensive third-party TuxCare solutions.
Great service from DA to be honest!

 

[nbejansen]

Still missing CloudLinux 9 support for PHP 7.4 and 8.0...

 

[pleskuser67553]

Hello, I used the GUI update in Tools & Settings > Updates, it brought down the new patch versions for PHP 8 with changed version numbers, and also patches for 7.4.33, I understand that its version number does not change, but can you confirm, am I looking at the patched version? It would be super helpful if that article actually showed the build numbers, if possible..?

plesk-php74 7.4.33-1centos.7.261021.1344 (PLESK_17_PHP74)

I think I answered my own question, I used the CLI route to check the build date:

# /opt/plesk/php/7.4/bin/php -v
PHP 7.4.33 (cli) (built: Oct 21 2026 13:52:02) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with the ionCube PHP Loader + ionCube24 v14.4.0, Copyright (c) 2002-2025, by ionCube Ltd.
    with Zend OPcache v7.4.33, Copyright (c), by Zend Technologies

 

[Martin Dias]

Still missing CloudLinux 9 support for PHP 7.4 and 8.0...

We are aware, and it will be added soon too.

 

[jnthn]

Thanks for providing patches for 7.4–8.1!

 

[the-real-jnthn]

when will sw-engine be updated? after the next 12 price increases?

 

[pleskuser67553]

For anyone interested, this is what I implemented until an update for sw-engine exists. I suggest to either enable a Firewall rule to allow access to port 8443 only from known IPs and/or use an SSH tunnel to access the admin panel.

Add port 8447 for known IPs too