Plesk: How to Patch PHP CVE-2026-109618 & CVE-2026-109619 (Critical RCE)
Disclosed 21 October 2026. Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can allow unauthenticated remote code execution. Plesk ships its own PHP builds (
plesk-php82,plesk-php83,plesk-php84…), and the patched versions arrive through Plesk Installer updates. The steps take a few minutes and do not touch your sites' files or databases.
Using cPanel? Follow the cPanel & CloudLinux guide. Using DirectAdmin? See the DirectAdmin guide.
Fixed PHP versions
| PHP branch | Safe version |
|---|---|
| 8.5 | 8.5.12 or later |
| 8.4 | 8.4.27 or later |
| 8.3 | 8.3.36 or later |
| 8.2 | 8.2.35 or later |
| 8.1 and older | No fix from the PHP project — see End-of-life PHP below |
Step 1 — Check your PHP versions (Plesk for Linux)
Run as root:
plesk bin php_handler --list
This lists every PHP handler on the server with its full version number. You can also check one version directly — Plesk installs each PHP under
/opt/plesk/php/X.Y/opt/plesk/php/8.3/bin/php -vAnything older than the table above needs the update. If you have automatic updates turned on, Plesk may already have installed the fix — this check will show it.
Step 2 — Install the updates
plesk installer install-all-updates
This installs every available update for your current Plesk version — including Plesk's PHP builds — without upgrading Plesk itself to a new major version.
Prefer the control panel? Go to Tools & Settings → Updates, and install the available updates in Plesk Installer.
Step 3 — Restart PHP-FPM
Restart the PHP-FPM services so the patched PHP is loaded everywhere:
for s in $(systemctl list-units --type=service --no-legend 'plesk-php*-fpm*' | awk '{print $1}'); do systemctl restart "$s"; done
Step 4 — Verify
Run the Step 1 check again. Every PHP handler should now show a version from the table above.
PHP from your operating system
Plesk can also run PHP from your Linux distribution (handlers without plesk- in the name in Step 1). Update those with the system package manager:
- AlmaLinux / Rocky Linux / CentOS / CloudLinux:
dnf upgrade 'php*' - Ubuntu / Debian:
apt update && apt upgrade
Distributions often fix security issues without changing the PHP version number, so for these handlers check your distribution's security notice for the two CVE IDs rather than the table above.
CloudLinux servers (ALT-PHP)
If your Plesk server runs CloudLinux with ALT-PHP, update those packages too:
yum update 'alt-php*'Plesk for Windows
Open Tools & Settings → Updates and install all available updates in Plesk Installer — this includes the PHP versions Plesk provides for Windows. Then check each PHP version under Tools & Settings → PHP Settings.
End-of-life PHP (7.4 / 8.0 / 8.1)
The PHP project no longer releases updates for 8.1 and older, so these handlers stay vulnerable even after updating. Switch the affected domains to PHP 8.3 or 8.4 in Websites & Domains → PHP Settings (check that your applications support it first). On CloudLinux servers, ALT-PHP with Extended Life Support (ELS) — included with a CloudLinux licence from us — keeps older versions patched: enable it with
tslzCLN --tuxcareyum update 'alt-php*'Want us to patch it for you?
Open a ticket and share server access — our team will apply the update, restart PHP and verify every version for you.