Scheduled maintenance is currently in progress. We will provide updates as necessary.
Posted Oct 21, 2026 - 16:08 CEST
Scheduled
Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allowing remote code execution were published today. All PHP versions are affected, regardless of the application in use.
What we are doing now:
We are installing the patched PHP versions on all managed servers: - PHP 8.2.35 - PHP 8.3.36 - PHP 8.4.27 - PHP 8.5.12
Websites running PHP 8.2 or newer are protected automatically after the update, no action needed on your side. PHP services will restart briefly during the update, which may cause short delays when loading pages.
What is still pending:
- PHP 7.4, 8.0 and 8.1: Plesk has announced patched packages but has not given a date yet. As soon as they are available, we will install them in a second maintenance window and announce it here. - Plesk panel (sw-engine): the fix is announced as a Plesk hotfix and will follow. - PHP 7.3 and older: there will be no fix for these versions. Affected websites remain vulnerable.
Our recommendation: please switch websites running PHP 8.1 or older to PHP 8.3 or newer in Plesk (Websites & Domains > PHP). Check your application's compatibility first. If you wish, we can do the switch for you.
Posted Oct 21, 2026 - 16:06 CEST
This scheduled maintenance affected: Server (Cloud Server, Bare Metal Server, Managed Services, Reseller Cloud).