Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[kyrill71]

Any ETA on 18.0.81#4?

 

[pleskpanel]

Loving that cPanel note for the PHP runtime used by WP Toolkit in the change log but where is the one for sw-engine?

 

[Powernerd]

Just wanted to say thank you to the Plesk team for how you handled php2shell today.
Much appreciated, and good luck with the sw-engine fix.

 

[the-real-jnthn]

is your claude 5 hour limit full or why is there no update coming for sw-engine? maybe we can all chip in for another account for you?

 

[Martin Dias]

Loving that cPanel note for the PHP runtime used by WP Toolkit in the change log but where is the one for sw-engine?

It will be available soon, it's going through the build pipeline

 

[brother4]

It's been a long day for some people today. And if you take a look at x, PHP wasn't the only big thing that happened today...

 

[andon]

We also had to take all Plesk admin interfaces offline. When will the 18.0.81 Update 4 be released? Can you say whether it will be a matter of 30 minutes or a few hours?

 

[Lucas K.]

We'd like to call it a day—it's been a long one—but we're waiting for the sw-engine update. So is it worth the wait because it's coming soon, or will it take a few more hours? If so, we'd like to call it a day. More information would be helpful.

 

[the-real-jnthn]

GTA 6 before sw-engine update?

 

[brother4]

V2 Scan Command:

printf 'php2shell: Vulnerability Scan CVE-2026-109618 and CVE-2026-109619\n'; pv=$(plesk version | awk '/^Product version:/{print $NF}'); req=18.0.81.4; [[ $pv == 18.0.80.* ]] && req=18.0.80.11; dpkg --compare-versions "$pv" ge "$req" && s=PATCHED || s=VULNERABLE; printf 'Plesk %s: %s\n' "$pv" "$s"; for p in /opt/plesk/php/*/bin/php; do [[ -x "$p" ]] || continue; l=$("$p" -v | head -n1); v=${l#PHP }; v=${v%% *}; case ${v%.*} in 8.2) req=8.2.35;; 8.3) req=8.3.36;; 8.4) req=8.4.27;; 8.5) req=8.5.12;; 7.4|8.0|8.1) d=$(date -d "$(awk '{print $5,$6,$7}' <<< "$l")" +%Y%m%d 2>/dev/null); if [[ -z $d ]]; then s=VERIFY; elif [[ $d -ge 20261021 ]]; then s="PATCHED (backport)"; else s=VULNERABLE; fi; printf 'PHP %s: %s\n' "$v" "$s"; continue;; 5.*|7.*) printf 'PHP %s: TUXCARE ELS / VERIFY\n' "$v"; continue;; *) printf 'PHP %s: VERIFY\n' "$v"; continue;; esac; dpkg --compare-versions "$v" ge "$req" && s=PATCHED || s=VULNERABLE; printf 'PHP %s: %s\n' "$v" "$s"; done

Example:

php2shell: Vulnerability Scan CVE-2026-109618 and CVE-2026-109619
Plesk 18.0.81.3: VULNERABLE
PHP 8.3.36: PATCHED
PHP 8.4.27: PATCHED
PHP 8.5.12: PATCHED

Commands when patch available:

plesk installer --select-release-current --upgrade-installed-components
systemctl start sw-cp-server

 

[ChristophRo]

looks like the update is here....
I'm currently updating all our server

 

[mow]

Commands when patch available:

plesk installer --select-release-current --upgrade-installed-components
systemctl start sw-cp-server

[...]Unpacking sw-engine (8.81.1-debian.11.261021.1037) over (8.81.0-debian.11.260903.0901) ...

 

[brother4]

Finally - Good night!

php2shell: Vulnerability Scan CVE-2026-109618 and CVE-2026-109619
Plesk 18.0.81.4: PATCHED
PHP 8.3.36: PATCHED
PHP 8.4.27: PATCHED
PHP 8.5.12: PATCHED

Keep an eye on this and GitLab as well:

• Security vulnerabilities: On October 21, 2026, Node.js disclosed 10 security vulnerabilities, including 4 rated high severity. The most critical, CVE-2026-111497, is a Brotli decoder memory corruption flaw that could potentially enable Remote Code Execution (RCE).
• Affected versions: Node.js 22.x, 24.x, and 26.x before the respective security updates. Older, unsupported versions may also be vulnerable.
• Security patches available: Fixed in Node.js 22.23.4, 24.22.1, and 26.12.1, released on October 21, 2026. Other high-severity CVEs include CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069, affecting DNS and TLS security checks.
• Source: Official Node.js Security Advisory

 

[Martin Dias]

18.0.81.4 was released
18.0.80.11 will follow soon

 

[andon]

18.0.81.4 was released
18.0.80.11 will follow soon

Very good. Thank you very much. We have already deployed it on all our servers.

 

[KlausZ]

is it safe to run a website with php 7.4.33? Some older installation want php 7.x
i see with /opt/plesk/php/7.4/bin/php -v that it is a build from today.
Thanks, Klaus

 

[Martin Dias]

is it safe to run a website with php 7.4.33? Some older installation want php 7.x
i see with /opt/plesk/php/7.4/bin/php -v that it is a build from today.
Thanks, Klaus

7.4 and newer was patched today to fix this isssue

 

[WebHostingAce]

Why isn't Plesk Obsidian 18.0.81 Update 4 appearing as an available update in the Plesk control panel?

 

[learning_curve]

7.4 and newer was patched today to fix this isssue

First off: Our thanks to Plesk. We patched updated everything yesterday, thanks to your swift involvement. All good. No issues.

Secondly: The reason we've quoted your message @Martin Dias is because the question below, relates directly to PHP 7.4.33, as we do have, one old, small application, for which, PHP 7.4.33 is the newest PHP release that it will run on (!) As stated, it is an old application and depending on the answer, it may be, that this incident, becomes its operational EOL, but it's worth us asking the question just in case:

plesk-php74 installed:
7.4.33-ubuntu.24.04.240507.1400

No PHP74_17 repository is published for resolute:
http://autoinstall.plesk.com/PHP74_17/dists/resolute/InRelease -> 404
http://autoinstall.plesk.com/PHP74_17/dists/resolute/Release -> 404

apt-cache madison plesk-php74-cli returns no versions.

Does Plesk have a plan to provide or publish a patched PHP 7.4 package for
CVE-2026-109618 / CVE-2026-109619 that is compatible with Ubuntu 26.04.* LTS?

 

[nmdpa3]

Why isn't Plesk Obsidian 18.0.81 Update 4 appearing as an available update in the Plesk control panel?

I was wondering the same thing. For some reason, the only way to apply the update is through Tools & Settings → Updates → Components. Once the update is applied, Plesk correctly recognizes the version as 18.0.81 #4.

Strange indeed!