Question sw-engine fix for CVE-2026-109618/109619 on Plesk 18.0.72 (Ubuntu 18.04)?

[simmons]

Server operating system version

Ubuntu 18.04.6 LTS

Plesk version and microupdate number

Plesk Obsidian 18.0.72 Update 3

Hi, thanks for the quick fixes for the PHP handlers.

Question about sw-engine on older installs: my server runs Plesk Obsidian 18.0.72.3 on Ubuntu 18.04
(the latest version the installer offers for this OS). The PHP handlers (8.2.35, 8.3.36, 8.4.27 and
the 7.4 build of 21 Oct) installed fine, but sw-engine remains unpatched.

Is a sw-engine hotfix planned for 18.0.72 / Ubuntu 18.04, or is the dist-upgrade to a supported OS
the only way to get the panel fixed? In the meantime, is setting session.upload_progress.enabled = 0
in sw-engine's php.ini a reasonable interim mitigation?

Thanks!

 

[Hangover2]

Do you have the "The Extended Lifecycle Support (ELS)" and is the TuxCare ELS extension active?
Log in to Plesk using your administrator credentials. Then go to [B]Tools & Settings[/B] > [B]License Information[/B], and check the status of the TuxCare service license.

see: Plesk Version Lifecycle Policy

Ubuntu 18.04

Plesk continues to deliver the new Plesk Obsidian version with the usual schedule including new features, and functional and security updates if it doesn’t contradict the Software delivered by the OS vendor until the Duration of Extended Lifecycle Support: October 1, 2024 – January 1, 2028.

 

[Martin Dias]

Patches released only for the supported Plesk versions.
If your server is super outdated as you say, I would recommend you to dist upgrade as soon as possible or migrate to a modern OS.
Alternatively get the ELS license to update Plesk: TuxCare Extended Lifecycle Support extension - Plesk Extended Lifecycle Support OSes Update
In the meantime I would recommend at least blocking panel access to external IPs (ports 8443, 8880).

 

[WSNHosting]

GitHub - HOSTED-POWER/php_uploadprogress_guard: Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. PHP 5.

Protects an unpatched PHP against php2shell (CVE-2026-109618 / CVE-2026-109619): a small extension that mirrors the official fix component by component and steps aside once the engine carries it. P...

github.com