Back Support.Plesk

Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP ...

Support.Plesk • October 21, 2026

Two security vulnerabilities were discovered in PHP. As a result, all PHP versions shipped with Plesk are also affected. These security vulnerabilities have been identified as CVE-2026-109618 and CVE-2026-109619.

Affected product version

Both vulnerabilities are rated critical (CVSS scores of 9.2). Remote code execution (RCE) is possible on affected PHP versions.

A fix is in development. The PHP vendor has scheduled the release of fixed PHP versions for 21 October 2026 at 14:00 UTC ( PHP News Archive | 20 Oct 2026 ). After that, Plesk will rebuild the following and deliver them to Plesk servers:

PHP builds from Plesk: 7.4 (EOL), 8.0 (EOL), 8.1 (EOL), 8.2, 8.3, 8.4, 8.5

Plesk Obsidian 18.0.80 and 18.0.81 will receive a fix for sw-engine (PHP engine used by Plesk itself)

This article will be updated with the patched versions and mitigation steps as soon as they are available.

Fixes for Plesk for Linux are already available for PHP 8.2 (as 8.2.35), 8.3 (as 8.3.36), 8.4 (as 8.4.27) and 8.5 (as 8.5.12). Older PHP versions (7.4, 8.0, 8.1) don't have fixes yet.

Fixes for Plesk for Windows are not available yet.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like WordPress and Drupal. Exploitation attempts were observed as early as October 17, four days before the patches were released. The PHP security team released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but older versions such as PHP 8.1 and below will not receive official fixes. Organizations are urged to patch immediately or isolate affected systems to mitigate risks. The vulnerabilities were discovered by researchers at Wiz and Calif, with assistance from OpenAI's AI models. 785 sources 73

Extracted Entities

CVEs (2)

CVE-2026-109618 CVE-2026-109619

Platforms (4)

Linux PHP Plesk Windows