Facebook
Twitter-
The new Python extension is now available. It allows customers to deploy and manage WSGI-based Python applications on their websites directly from Plesk.
-
Debian 11 has reached its end-of-life (vendor EOL date - August 31, 2026). Plesk Obsidian 18.0.81 is the last release to support it.
If you are running Plesk Obsidian on Debian 11, we recommend you upgrade those servers to Debian 12 using our dist-upgrade tool.
Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?
- Thread starter brother4
- Start date
but read the article linked first.
PHP: News Archive - 2026
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
www.php.net
only exploitable under very unusual combination of configuration and application code.
"... Since this setup is unlikely in practice, ..."but read the article linked first.
PHP: News Archive - 2026
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
only exploitable under very unusual combination of configuration and application code.
Really? Hackers will just upload their own script that configures the system the way they want it, then start the attack.
One strategy would be to set
in the additional directives, so that the value cannot be changed by the subscription owner via an .ini file. It will end up in the /opt/plesk/php/<version>/etc/php-fpm.d/*.conf file of the domain. But that can be tedious if you have many domains on a server as it needs to be done on a "per domain" basis.
Another solution can be
That will set the variable for all PHP instances using that version while it disables user .ini files altogether. As the session.upload_progress variable cannot be set by ini_set() it will keep an attacker from making the environment fit a malicious purpose.
Opinions on this?
That must be authorized and authenticated hackers though ....
Just think about all the domains that are compromised through successful hacking attempts already. I am not speaking about new attempts, just use the existing infections. There are tons of Joomla and Wordpress installations that are malware infected, and these already have the possibility to upload scripts into the subscription freely.
There is a critical distinction between two types of attacks: compromising individual websites within a hosting subscription and gaining command-line or root access to the underlying server.
The former is serious but typically limited to activities such as distributing spam, hosting phishing pages, or attacking other systems. The latter potentially compromises the entire server.
PHP2Shell exploits fall into this far more dangerous category, as does the newly disclosed vulnerability. The particular concern is that attackers who already control compromised websites could escalate their access. By uploading custom PHP scripts and manipulating certain PHP settings, they may be able to establish the conditions necessary for a PHP2Shell exploit, turning an isolated website compromise into a server-wide security breach.
For this reason, I believe describing the scenario as "unlikely" significantly understates the risk. Once an attacker has compromised a hosting subscription, they may be able to deliberately establish the conditions required for exploitation. What might otherwise be considered an unlikely scenario can thus become a deliberately prepared, attack-ready environment.
And for the same reason I believe that disabling user defined .ini files plus disabling session.upload_progress.enabled is essential - until PHP provides another fix for the mess.
ok, I agree that setting wouldn't harm any application so why not. I just wanted to avoid panicking about this. It's far from the threat that php2shell was.
