• The new Python extension is now available. It allows customers to deploy and manage WSGI-based Python applications on their websites directly from Plesk.
  • The Plesk Mobile apps for iOS and Android and the Plesk Mobile Center extension have been deprecated, and are no longer available for new installations. In Plesk Obsidian 18.0.84, the Plesk Mobile Center extension will be removed from servers during the upgrade, and the Plesk Mobile apps will lose their server management features.
  • The Social Login extension has been deprecated and will be removed in Plesk Obsidian 18.0.84. After that, it will no longer be possible to log in to Plesk with a Google, Facebook, GitHub account, or with a passkey. Plesk usernames and passwords, as well as logging in with a WebPros Account, are not affected.

Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

V2 Scan Command:
Bash: 
printf 'php2shell: Vulnerability Scan CVE-2026-109618 and CVE-2026-109619\n'; pv=$(plesk version | awk '/^Product version:/{print $NF}'); req=18.0.81.4; [[ $pv == 18.0.80.* ]] && req=18.0.80.11; dpkg --compare-versions "$pv" ge "$req" && s=PATCHED || s=VULNERABLE; printf 'Plesk %s: %s\n' "$pv" "$s"; for p in /opt/plesk/php/*/bin/php; do [[ -x "$p" ]] || continue; l=$("$p" -v | head -n1); v=${l#PHP }; v=${v%% *}; case ${v%.*} in 8.2) req=8.2.35;; 8.3) req=8.3.36;; 8.4) req=8.4.27;; 8.5) req=8.5.12;; 7.4|8.0|8.1) d=$(date -d "$(awk '{print $5,$6,$7}' <<< "$l")" +%Y%m%d 2>/dev/null); if [[ -z $d ]]; then s=VERIFY; elif [[ $d -ge 20261021 ]]; then s="PATCHED (backport)"; else s=VULNERABLE; fi; printf 'PHP %s: %s\n' "$v" "$s"; continue;; 5.*|7.*) printf 'PHP %s: TUXCARE ELS / VERIFY\n' "$v"; continue;; *) printf 'PHP %s: VERIFY\n' "$v"; continue;; esac; dpkg --compare-versions "$v" ge "$req" && s=PATCHED || s=VULNERABLE; printf 'PHP %s: %s\n' "$v" "$s"; done

Example:
php2shell: Vulnerability Scan CVE-2026-109618 and CVE-2026-109619
Plesk 18.0.81.3: VULNERABLE
PHP 8.3.36: PATCHED
PHP 8.4.27: PATCHED
PHP 8.5.12: PATCHED
Click to expand...
Commands when patch available:
Bash: 
plesk installer --select-release-current --upgrade-installed-components
systemctl start sw-cp-server
 
Finally - Good night!
php2shell: Vulnerability Scan CVE-2026-109618 and CVE-2026-109619
Plesk 18.0.81.4: PATCHED
PHP 8.3.36: PATCHED
PHP 8.4.27: PATCHED
PHP 8.5.12: PATCHED
Click to expand...
Keep an eye on this and GitLab as well:
  • Security vulnerabilities: On October 21, 2026, Node.js disclosed 10 security vulnerabilities, including 4 rated high severity. The most critical, CVE-2026-111497, is a Brotli decoder memory corruption flaw that could potentially enable Remote Code Execution (RCE).
  • Affected versions: Node.js 22.x, 24.x, and 26.x before the respective security updates. Older, unsupported versions may also be vulnerable.
  • Security patches available: Fixed in Node.js 22.23.4, 24.22.1, and 26.12.1, released on October 21, 2026. Other high-severity CVEs include CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069, affecting DNS and TLS security checks.
  • Source: Official Node.js Security Advisory
 
is it safe to run a website with php 7.4.33? Some older installation want php 7.x
i see with /opt/plesk/php/7.4/bin/php -v that it is a build from today.
Thanks, Klaus
 
Martin Dias said:
7.4 and newer was patched today to fix this isssue
Click to expand...
First off: Our thanks to Plesk. We patched updated everything yesterday, thanks to your swift involvement. All good. No issues.

Secondly: The reason we've quoted your message @Martin Dias is because the question below, relates directly to PHP 7.4.33, as we do have, one old, small application, for which, PHP 7.4.33 is the newest PHP release that it will run on (!) As stated, it is an old application ;) and depending on the answer, it may be, that this incident, becomes its operational EOL, but it's worth us asking the question just in case:

plesk-php74 installed:
7.4.33-ubuntu.24.04.240507.1400

No PHP74_17 repository is published for resolute:
http://autoinstall.plesk.com/PHP74_17/dists/resolute/InRelease -> 404
http://autoinstall.plesk.com/PHP74_17/dists/resolute/Release -> 404

apt-cache madison plesk-php74-cli returns no versions.

Does Plesk have a plan to provide or publish a patched PHP 7.4 package for
CVE-2026-109618 / CVE-2026-109619 that is compatible with Ubuntu 26.04.* LTS?
 
WebHostingAce said:
Why isn't Plesk Obsidian 18.0.81 Update 4 appearing as an available update in the Plesk control panel?
Click to expand...
I was wondering the same thing. For some reason, the only way to apply the update is through Tools & Settings → Updates → Components. Once the update is applied, Plesk correctly recognizes the version as 18.0.81 #4.

Strange indeed!
 
brother4 said:
Finally - Good night!

Keep an eye on this and GitLab as well:
  • Security vulnerabilities: On October 21, 2026, Node.js disclosed 10 security vulnerabilities, including 4 rated high severity. The most critical, CVE-2026-111497, is a Brotli decoder memory corruption flaw that could potentially enable Remote Code Execution (RCE).
  • Affected versions: Node.js 22.x, 24.x, and 26.x before the respective security updates. Older, unsupported versions may also be vulnerable.
  • Security patches available: Fixed in Node.js 22.23.4, 24.22.1, and 26.12.1, released on October 21, 2026. Other high-severity CVEs include CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069, affecting DNS and TLS security checks.
  • Source: Official Node.js Security Advisory
Click to expand...

I'd like to be able to patch these anytime soon too. What is the proper way?
 
Harm Jakob Tolsma said:
I'd like to be able to patch these anytime soon too. What is the proper way?
Click to expand...
You can view / install / uninstall versions, via the Plesk Node.js Toolkit Extension, or, view the released (installed) versions via: # plesk ext nodejs --versions
If your Plesk install is fully up to date, you should see that all of the 22.23.4, 24.22.1, and 26.12.1 Node.js releases (i.e. the patched ones) are already present.
Ours are, so there was no actual work necessary (for us)
 
learning_curve said:
You can view / install / uninstall versions, via the Plesk Node.js Toolkit Extension, or, view the released (installed) versions via: # plesk ext nodejs --versions
If your Plesk install is fully up to date, you should see that all of the 22.23.4, 24.22.1, and 26.12.1 Node.js releases (i.e. the patched ones) are already present.
Ours are, so there was no actual work necessary (for us)
Click to expand...
Mine are behind and I dont see any update options. Only the 'refresh' button, but that doesnt do very much.
 
Harm Jakob Tolsma said:
Mine are behind and I dont see any update options. Only the 'refresh' button, but that doesnt do very much.
Click to expand...
Obviously we have no idea of your server / os / config etc etc as you have no forum signature, but assuming you're in a position to run ALL upgrades meaning: Having complete backups / server snapshot etc just in case, then you could run:
Bash: 
plesk installer --select-release-current --upgrade-installed-components
And re-check those installed versions
 
Unfortunately plesk installer --select-release-current --upgrade-installed-components didnt fix it.

But I managed to fix it by going to Tools & Settings then picking Scheduled Tasks (Cron jobs).
In the list of tasks, I searched for 'node' and then started that task using Run Now.

After checking using plesk ext nodejs --versions, I saw all the updated versions.

Thanks for the help tho!
 
learning_curve said:
First off: Our thanks to Plesk. We patched updated everything yesterday, thanks to your swift involvement. All good. No issues.

Secondly: The reason we've quoted your message @Martin Dias is because the question below, relates directly to PHP 7.4.33, as we do have, one old, small application, for which, PHP 7.4.33 is the newest PHP release that it will run on (!) As stated, it is an old application ;) and depending on the answer, it may be, that this incident, becomes its operational EOL, but it's worth us asking the question just in case:

plesk-php74 installed:
7.4.33-ubuntu.24.04.240507.1400

No PHP74_17 repository is published for resolute:
http://autoinstall.plesk.com/PHP74_17/dists/resolute/InRelease -> 404
http://autoinstall.plesk.com/PHP74_17/dists/resolute/Release -> 404

apt-cache madison plesk-php74-cli returns no versions.

Does Plesk have a plan to provide or publish a patched PHP 7.4 package for
CVE-2026-109618 / CVE-2026-109619 that is compatible with Ubuntu 26.04.* LTS?
Click to expand...
For Ubuntu 26, the EOL PHP is not offered / build by us
From the Package name seems its a leftover from before a dist upgrade, so I would recommend either to update the app to run on a newer PHP, or since that will probably we too complicated/costly move it to a host that still runs Ubuntu 24 where we still have PHP 7.4 up to date.
I would not recommend leaving that application reachable on a unpatched PHP.
 
nmdpa3 said:
I was wondering the same thing. For some reason, the only way to apply the update is through Tools & Settings → Updates → Components. Once the update is applied, Plesk correctly recognizes the version as 18.0.81 #4.

Strange indeed!
Click to expand...
I know. This is very strange!
 
You must log in or register to reply here.

Similar threads

D
Question ETA for nginx 1.30.6 (Critical CVE-2026-15176, CVE-2026-93479, CVE-2026-97205)
Replies
8
Views
2K
pleskuser67553
P
E
Plesk Security Updates for PHP CVE-2026-109618 and CVE-2026-109619
Replies
0
Views
2K
Elvis Plesky
E
P
Resolved Brotli CVE-2026-111497
Replies
4
Views
2K
Bitpalast
Bitpalast
R
Issue Three more CVEs for nginx just hit - one rated as critical with DoS and RCE possible
Replies
3
Views
3K
rhall
R
I
Resolved critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)
2
Replies
25
Views
6K
manni
M
Back
Top