Vulnerability CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)

Two security vulnerabilities were discovered in PHP. As a result, all PHP versions shipped with Plesk are also affected. These security vulnerabilities have been identified as CVE-2026-109618 and CVE-2026-109619 and are also known as PHP2Shell.

Affected product version

PHP on Plesk Obsidian for Linux:

PHP on Plesk Obsidian for Windows:

Plesk Obsidian ( sw-engine component):

Note: for older versions of PHP (5.6, 7.2, 7.3) it is recommended to use paid TuxCare Extended Lifecycle Support for PHP .

Both vulnerabilities are rated critical (CVSS scores of 9.2). Remote code execution (RCE) is possible on affected PHP versions.

Update Plesk to the latest available version .

A fix is available for most affected versions. The PHP vendor released the fixed PHP versions on 21 October 2026 at 14:00 UTC ( PHP News Archive | 21 Oct 2026 ).

Fixes for Plesk for Linux are already available for PHP 8.2 (as 8.2.35), 8.3 (as 8.3.36), 8.4 (as 8.4.27) and 8.5 (as 8.5.12). Fixes for EOL PHP versions on Plesk for Linux 7.4.33, 8.0.30, 8.1.34 have the same version number, but different build date. Versions built on 21 October 2026 have fixes included.

Fixes for Plesk for Windows are available for PHP 8.2 (as 8.2.35), 8.3 (as 8.3.36), 8.4 (as 8.4.27) and 8.5 (as 8.5.12)

Change Log for Plesk Obsidian / PHP Updates

Fixes for sw-engine / plesk-engine (PHP engine used by Plesk itself) are already available in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11 for both Plesk for Linux and Plesk for Windows:

Plesk Obsidian 18.0.81 Update 4

Plesk Obsidian 18.0.80 Update 11

Check the Plesk version installed on the server .

Additional Information:

If the update fails with The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5B6AB2160B50DB96 error (on Ubuntu/Debian), check the Unable to update Plesk: The following signatures couldn't be verified because the public key is not available article.

How to check PHP version on Plesk server:

Navigate to Tools & Settings > PHP Settings . Versions should be reflected in handler names:

Connect to the server via SSH

Execute the command below for corresponding PHP version (8.3 is used in this example): # /opt/plesk/php/8.3/bin/php -v PHP 8.3.36 (cli) (built: Oct 21 2026 08:04:57) (NTS) Copyright (c) The PHP Group Zend Engine v4.3.36, Copyright (c) Zend Technologies with Zend OPcache v8.3.36, Copyright (c), by Zend Technologies

Execute the command below for corresponding PHP version (8.3 is used in this example):

# /opt/plesk/php/8.3/bin/php -v PHP 8.3.36 (cli) (built: Oct 21 2026 08:04:57) (NTS) Copyright (c) The PHP Group Zend Engine v4.3.36, Copyright (c) Zend Technologies with Zend OPcache v8.3.36, Copyright (c), by Zend Technologies