Issue How Can I Install the Latest Security-Patched PHP Version on Windows Server 2008 R2 Using Plesk?

[Sushma Bugade]

I am facing an issue with PHP versions on my server and need your technical guidance.

My Current Server Environment:

• Operating System: Windows Server 2008 R2
• Control Panel: Plesk
• Current PHP Version: PHP 7.3.33

My hosting provider has informed me that PHP 7.3.33 is affected by critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

1. Why are the latest PHP versions not listed under Plesk's PHP Settings or PHP Handler management?
2. Is it possible to manually install an additional PHP version, such as PHP 8.5, alongside my existing PHP 7.3.33?
3. Is there any officially supported or security-patched PHP 7.3.33 build available for Windows Server 2008 R2?

If upgrading PHP is not possible because of the old operating system, what is the safest way to apply security patches and protect my existing website?

Thank you.

 

[Tobias Sorensson]

The short answer is that there is no security-patched PHP for your setup via Plesk. Windows Server 2008 R2 is not supported by Plesk Obsidian, so your Plesk version will never receive new PHP handlers, and the PHP project fixed CVE-2026-109618/109619 only in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. There is no official fix for PHP 7.3.

Recent PHP 8.x Windows builds don't support Server 2008 R2 either, so manually adding PHP 8.5 is not realistic. PHP 8.2.35 might run on 2008 R2 SP1, but that is unsupported territory and your site would have to be compatible with 8.2.

As a stopgap only, in the php.ini used by the PHP 7.3 handler (not .user.ini):

session.upload_progress.enabled = Off
memory_limit = -1
post_max_size = 8M        ; as low as your site tolerates
upload_max_filesize = 8M

Then recycle the IIS application pools / run iisreset.

memory_limit = -1 removes the memory cap that CVE-2026-109618 abuses, but it also means a runaway script can eat all your RAM. Keep an eye on the server. These settings reduce the risk. They do not fix the vulnerability.

The real fix is to migrate to a supported Windows Server (2019/2022/2025) with current Plesk Obsidian and PHP 8.2+. Plesk Migrator can move the subscriptions. Until then, also check the site for web shells or files modified since mid-October.

 

[Sushma Bugade]

Thank You