Important Plesk Obsidian Releases

[dash]

Hi all,

We are excited to release the anniversary edition Plesk Obsidian 18.0.70! Huge thanks to all our loyal customers! To celebrate, we have added a little gift. Want some fun? Just type DISCO on your Plesk screen. Let’s dance!
Release Notes: Plesk Obsidian 18.0.70

Panel and Hosting improvements​

Improved protections against brute-force and DDoS attacks on your Plesk server by rate-limiting login attempts.
The protection is enabled by default, to configure it, use the following options in panel.ini file:

[security]
bruteforceProtection.enabled ; Enables or disables brute force protection.
bruteforceProtection.rateLimit ; The number of failed access attempts allowed by an IP address.
bruteforceProtection.rateLimitPeriod ; The rate limit period in seconds.

(Plesk for Windows) Added a new 'components' CLI utility to allow users to manage server components. To see help on the utility usage, run the following command:

plesk bin components --help

Updated Plesk images on Microsoft Azure, Google Cloud, DigitalOcean, Amazon Web Services (including Amazon Lightsail) from Ubuntu 22.04 to Ubuntu 24.04 LTS. See more information about available Plesk cloud images.

Small Improvements​

Added the ability to resize interfaces and the installer up to 200% larger to improve accessibility.

Limited how many of tasks the Task Manager can query at one time and moved task cleanup jobs into batches to reduce CPU and RAM usage on high-load servers. This improves overall server performance. Also added debug messages for all Task Manager API operations.

Improved Plesk QCOW2 images to take up less disk space on installation, scale more effectively with more storage, and contain security and packaging updates.

Users can now configure the backup validation period by adding lines of the following pattern to the panel.ini file:

[pmm]
backupsValidationPeriod = 7 ;The backup validation period, in days.

Note: Backup validation can be cancelled by setting backupsValidationPeriod to 0.

(Plesk for Linux) Plesk now installs with a default secure TLS configuration.

(Plesk for Linux) It is no longer possible to bypass the default PHP performance settings in PHP-FPM handlers using the .user.ini settings file or the PHP ini_set() command. The default PHP performance settings should be optimal for most websites, and changing the settings could impact the websites’ performance.

Deployment changes, deprecations, and removals​

• (Plesk for Windows) Plesk removed support for BIND DNS due to security and maintenance risks.
  Note: If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS.

Plesk Obsidian Stability​

• Dozens of Bug fixes based on our customer's reports.

Security and Third-party Components updates and drops​

Plesk continues to deliver fresh and modern versions of supplied and supported third-party software.
We strongly recommend staying up2date with Plesk!

Linux​

• Updated ModSecurity to version 2.9.9 to fix the CVE-2025-47947 vulnerability.
• Upgraded the sw-engine PHP version to 8.4.6.
• Updated the courier-unicode version to 2.3.2.
• Updated the courier-imap version to 5.2.11.
• Updated the courier-authlib version to 0.72.4.
• Updated the libarchive version to 2.3.2.

Windows​

• Updated ASP.NET Core 9.0 to version 9.0.5.
• Updated ASP.NET Core 8.0 to version 8.0.16.
• Upgraded the plesk-engine PHP version to 8.4.7.
• Updated the OWASP ModSecurity CRS version to 4.14.0.
• Updated MailEnable Standard to version 10.52.
• Updated Node.js to version 20.19.2.