Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[Harm Jakob Tolsma]

Finally - Good night!

Keep an eye on this and GitLab as well:

• Security vulnerabilities: On October 21, 2026, Node.js disclosed 10 security vulnerabilities, including 4 rated high severity. The most critical, CVE-2026-111497, is a Brotli decoder memory corruption flaw that could potentially enable Remote Code Execution (RCE).
• Affected versions: Node.js 22.x, 24.x, and 26.x before the respective security updates. Older, unsupported versions may also be vulnerable.
• Security patches available: Fixed in Node.js 22.23.4, 24.22.1, and 26.12.1, released on October 21, 2026. Other high-severity CVEs include CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069, affecting DNS and TLS security checks.
• Source: Official Node.js Security Advisory

I'd like to be able to patch these anytime soon too. What is the proper way?

 

[learning_curve]

I'd like to be able to patch these anytime soon too. What is the proper way?

You can view / install / uninstall versions, via the Plesk Node.js Toolkit Extension, or, view the released (installed) versions via: # plesk ext nodejs --versions
If your Plesk install is fully up to date, you should see that all of the 22.23.4, 24.22.1, and 26.12.1 Node.js releases (i.e. the patched ones) are already present.
Ours are, so there was no actual work necessary (for us)

 

[Harm Jakob Tolsma]

You can view / install / uninstall versions, via the Plesk Node.js Toolkit Extension, or, view the released (installed) versions via: # plesk ext nodejs --versions
If your Plesk install is fully up to date, you should see that all of the 22.23.4, 24.22.1, and 26.12.1 Node.js releases (i.e. the patched ones) are already present.
Ours are, so there was no actual work necessary (for us)

Mine are behind and I dont see any update options. Only the 'refresh' button, but that doesnt do very much.

 

[learning_curve]

Mine are behind and I dont see any update options. Only the 'refresh' button, but that doesnt do very much.

Obviously we have no idea of your server / os / config etc etc as you have no forum signature, but assuming you're in a position to run ALL upgrades meaning: Having complete backups / server snapshot etc just in case, then you could run:

plesk installer --select-release-current --upgrade-installed-components

And re-check those installed versions

 

[Harm Jakob Tolsma]

Unfortunately plesk installer --select-release-current --upgrade-installed-components didnt fix it.

But I managed to fix it by going to Tools & Settings then picking Scheduled Tasks (Cron jobs).
In the list of tasks, I searched for 'node' and then started that task using Run Now.

After checking using plesk ext nodejs --versions, I saw all the updated versions.

Thanks for the help tho!

 

[Martin Dias]

First off: Our thanks to Plesk. We patched updated everything yesterday, thanks to your swift involvement. All good. No issues.

Secondly: The reason we've quoted your message @Martin Dias is because the question below, relates directly to PHP 7.4.33, as we do have, one old, small application, for which, PHP 7.4.33 is the newest PHP release that it will run on (!) As stated, it is an old application and depending on the answer, it may be, that this incident, becomes its operational EOL, but it's worth us asking the question just in case:

plesk-php74 installed:
7.4.33-ubuntu.24.04.240507.1400

No PHP74_17 repository is published for resolute:
http://autoinstall.plesk.com/PHP74_17/dists/resolute/InRelease -> 404
http://autoinstall.plesk.com/PHP74_17/dists/resolute/Release -> 404

apt-cache madison plesk-php74-cli returns no versions.

Does Plesk have a plan to provide or publish a patched PHP 7.4 package for
CVE-2026-109618 / CVE-2026-109619 that is compatible with Ubuntu 26.04.* LTS?

For Ubuntu 26, the EOL PHP is not offered / build by us
From the Package name seems its a leftover from before a dist upgrade, so I would recommend either to update the app to run on a newer PHP, or since that will probably we too complicated/costly move it to a host that still runs Ubuntu 24 where we still have PHP 7.4 up to date.
I would not recommend leaving that application reachable on a unpatched PHP.

 

[learning_curve]

@Martin Dias No worries. We'll EOL the application (operationally) and remove the old PHP package.
Everything we use (apart from that App and Plesk itself) is on PHP 8.5.12. Thanks!

 

[WebHostingAce]

I was wondering the same thing. For some reason, the only way to apply the update is through Tools & Settings → Updates → Components. Once the update is applied, Plesk correctly recognizes the version as 18.0.81 #4.

Strange indeed!

I know. This is very strange!

 

[Martin Dias]

I know. This is very strange!

Might been daily task running before the used CDN server had the updated info, but that is just a guess at the moment
Anyway triggering the installer manually finds it

 

[WebHostingAce]

Might been daily task running before the used CDN server had the updated info, but that is just a guess at the moment
Anyway triggering the installer manually finds it

Only Tools & Settings → Updates → Components works.

The “Check for Updates” button on the Plesk home page did not indicate that an update was available.

Even under Tools & Settings → Updates → Install or Update Product, the update was not listed as available.

However, I was able to find and install the update through Tools & Settings → Updates → Components.

 

[WSNHosting]

GitHub - HOSTED-POWER/php_uploadprogress_guard: Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP 5.

Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. P...

github.com