Update PHP on Plesk for php2shell (CVE-2026-109618 and CVE-2026-109619)

Only check systems you own or are responsible for.

Short answer

Plesk now has fixed PHP builds for both Linux and Windows, and its call to action is to update Plesk to the latest available version. Install the Plesk updates, then confirm each Plesk PHP version you use shows 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or newer).

On Linux, Plesk’s end-of-life PHP 7.4.33, 8.0.30 and 8.1.34 keep the same version numbers: Plesk says builds made on 21 Oct 2026 include the fixes, so for those you check the build date, not the number. Plesk’s own interface engine (sw-engine) is fixed in Plesk Obsidian 18.0.80 Update 11 and 18.0.81 Update 4. This comes from Plesk’s advisory, which was updated on 22 Oct 2026 (04:08 UTC when we last read it). It has been changing quickly, so re-read it before you finish.

What this is

php.net announced PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 Oct 2026. They fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which php.net says can allow unauthenticated remote code execution. Both are rated CVSS 4.0 9.2 by the PHP Group. “php2shell” is the name Wiz Research gave the findings, not an official PHP name.

Where your PHP comes from

A Plesk server can run two kinds of PHP. They are updated differently.

Handlers whose ID starts with plesk-php (for example plesk-php83-fpm) are Plesk-provided. Plesk’s KB also lists handlers “by OS vendor” (source).

Step 1: See which PHP each domain uses

In Plesk, open Tools & Settings > PHP Settings: versions appear in the handler names. Per domain, look at Domains > example.com > PHP Settings. Or over SSH (read-only):

plesk bin php_handler --list
plesk db -sNe "select name, php_handler_id from hosting h, domains dom where dom.id = h.dom_id and php = 'true'"

Step 2: Install the Plesk updates (Plesk-provided PHP)

Take a snapshot or backup first, especially if the server is also due other upgrades. Then, per Plesk’s update guide:

• Interface: Tools & Settings > Updates > Update Components > Continue. Port 8447 must be open in the firewall.
• SSH: plesk installer update

Plesk’s KB says websites stay online during an update, and a service is restarted if its component is updated. Plesk installs updates nightly if Automatically install Plesk updates is on (Tools & Settings > Update Settings), but do not wait for it. Plesk’s change log lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 under “PHP Updates (21 October 2026)”.

Step 3: Restart and verify

Check the binary for each PHP version you use on Plesk for Linux (8.3 shown), as in Plesk’s advisory:

/opt/plesk/php/8.3/bin/php -v

The first line shows the PHP version; for 8.3 it should read 8.3.36 or newer. For Plesk’s PHP 7.4, 8.0 and 8.1 on Linux the version number stays 7.4.33, 8.0.30 or 8.1.34 and the build date is what counts: Plesk says versions built on 21 Oct 2026 have the fixes.

That shows the file on disk, not the process serving your site. To be sure running workers use the new build, restart the Plesk PHP-FPM services (the KB uses the plesk-php* service names):

systemctl list-units 'plesk-php*' --no-legend
sudo systemctl restart plesk-php83-fpm   # use the unit names listed above; repeat for each

Then enter the version in our checker or compare it with the fixed versions table. The checker compares what you type, in your browser.

Step 4: Update OS-vendor PHP (if any domain uses it)

Distro versions keep older numbers because fixes are back-ported, so compare with the vendor’s fixed package version. Plesk’s KB says that on Plesk Obsidian system PHP can be upgraded independently of Plesk.

Ubuntu 20.04 and older get the fix only through Ubuntu Pro. Red Hat also fixed RHEL 10 php (8.3), RHEL 9 php (8.0) and php:8.2, and RHEL 8 php:7.4, and Rocky Linux, Oracle Linux and AlmaLinux have published advisories for some of their streams; the exact package strings for each stream are in the fixed versions table. The RHEL 9 php:8.4 module has no fix yet: Red Hat lists it as “Affected”. Debian 11 is only covered by Freexian’s paid Extended LTS; Debian itself lists no fix for it. Check your own stream and distro on the hosting status and fixed-versions pages.

Debian/Ubuntu (adjust the version to match your handler):

sudo apt update
sudo apt install --only-upgrade 'php8.3*'
dpkg-query -W 'php8.3*'
sudo systemctl restart php8.3-fpm

RHEL family:

sudo dnf check-update 'php*'
sudo dnf upgrade 'php*'    # only if your distro lists a fixed build for your PHP stream
rpm -q php-fpm
sudo systemctl restart php-fpm

If a domain uses Apache with mod_php rather than FPM, restart Apache (apache2 or httpd) instead.

Step 5: Move a domain to a fixed PHP version

PHP 7.4, 8.0 and 8.1 are end of life at php.net. Plesk rebuilt them on Linux with the fixes but kept the version numbers, so a domain on one of them is only fixed if the build date is 21 Oct 2026 or later. The lasting answer is a supported, fixed handler (8.2 or newer). Back up the site and test it first, since version jumps can break applications. A distro-patched OS-vendor handler from Step 4 is another option where your OS has a fixed package.

• Interface: Domains > example.com > PHP Settings > choose the version and handler > apply (KB).
• SSH: plesk bin domain -u example.com -php_handler_id plesk-php83-fpm

Plesk’s KB warns that its bulk-switch script restarts web services each time it assigns a handler, so run it in a maintenance window (KB warning). For PHP 5.6, 7.2 and 7.3, Plesk recommends paid TuxCare Extended Lifecycle Support for PHP.

Other components and older PHP

Recheck the advisory after each update. Run plesk version to see your Plesk release.

Need it done for your setup?

Mixed handlers, Windows, or end-of-life PHP make this fiddly. Our $49 personal patch plan gives you written steps for your exact setup by email within 24h: see the details.

Independent site, not affiliated with Plesk, the PHP Group or php.net.