PHP2Shell on Plesk: Fixed PHP Handlers and Build Dates

As of 23 October 2026, Plesk has published fixed PHP handlers for PHP2Shell on Linux and Windows, plus a fixed version of the PHP engine that runs the Plesk interface itself. Exploitation attempts are widely reported, confirmed successful compromises are not publicly documented, and CISA has not added the flaws to its Known Exploited Vulnerabilities (KEV) catalog.

The direct answer: on a Plesk server you manage, update Plesk to the latest available version, make sure every PHP handler your sites use is on a fixed build, and check the result. For PHP 8.2 to 8.5 the fixed builds have new version numbers. For PHP 7.4, 8.0 and 8.1 they don't: the only visible difference is a build date of 21 October 2026. If your site is on a Plesk server run by a hosting company, the host does the update, and our guide to PHP2Shell on shared hosting covers what to check from your side.

PHP2Shell is the name for two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. This guide covers Plesk Obsidian only.

What Plesk Fixed

Plesk's knowledge base article on PHP2Shell, created 20 October and last edited 22 October 2026, lists the fixed builds for both operating systems. It says PHP released its fixes "on 21 October 2026 at 14:00 UTC."

The Plesk Obsidian change log records the same release as "PHP Updates 21 October 2026," with "Backport the fix for CVE-2026-109618 and CVE-2026-109619" to 8.1.34, 8.0.30 and 7.4.33 on Linux. A backport means Plesk copied the fix into the version it already ships, which is why those three version numbers didn't change.

The Panel's Own PHP: sw-engine and plesk-engine

Plesk's own interface runs on PHP too, but not on your website handlers. It has its own engine: sw-engine on Linux and plesk-engine on Windows. Plesk's advisory calls it the "PHP engine used by Plesk itself." Updating your site handlers does not update this engine, and updating the engine does not update your site handlers.

The fix for the panel engine ships inside Plesk updates. The change log lists "Updated plesk-engine and sw-engine PHP to version 8.4.27" in two releases, both dated 21 October 2026:

To see your Plesk version, Plesk's documentation says to go to Tools & Settings > About Plesk, or run plesk version (or plesk -v) on the server. If the product version is below the fixed update for your release line, the panel's own PHP is still unpatched, even if every website handler is fixed.

Who Patches Plesk: You or Your Host?

That depends on who has administrator access to the server.

If you aren't sure which applies, ask your provider in writing before you assume either way.

How to Install the Updates

Plesk's call to action is "Update Plesk to the latest available version." Its article on how to install Plesk updates gives two routes:

1. Take a backup or server snapshot first. Our guide to backups and recovery explains what a usable backup includes.
2. In the Plesk interface: "Go to Tools & Settings and click Updates. On the Updates and Upgrades page, click Update Components. Click Continue to begin the update procedure."
3. Or on the command line, connect over SSH (Linux) or RDP (Windows Server) and run plesk installer update. On Windows, start the command prompt as an Administrator.
4. Check the Plesk version with plesk version, then check each PHP handler (next section).

Plesk notes that during an update, "Plesk may go offline for several minutes, if updates require a Plesk restart," but "Websites will stay online." It also says that by default, Plesk installs updates every night through its daily task "if the option Automatically install Plesk updates is enabled at Tools & Settings > Update Settings." If that option is off on your server, nothing happened automatically.

One known error on Ubuntu and Debian: if the update fails with "NO_PUBKEY 5B6AB2160B50DB96," Plesk's advisory links a separate article on fixing the missing signing key. Don't skip the update because of it.

How to Check Each PHP Handler

Plesk gives two ways to check. In the interface, "Navigate to Tools & Settings > PHP Settings menu. Versions should be reflected in handler names." On a Linux server, run the handler's own PHP binary. Plesk's example uses PHP 8.3; replace 8.3 with each version you have installed:

/opt/plesk/php/8.3/bin/php -v

Plesk's sample output for a fixed build reads "PHP 8.3.36 (cli) (built: Oct 21 2026 08:04:57) (NTS)." For 8.2 to 8.5, the version number is enough. For 7.4, 8.0 and 8.1, the number looks the same before and after the fix, so read the "built:" date:

That command checks the binary on disk. It doesn't prove the running PHP-FPM processes picked it up. For that, load a temporary phpinfo() page through each site, read the version and build date, then delete the file. Our guide on how to check your PHP version covers each method, and the PHP2Shell version lookup tells you whether a given build is fixed.

Restart the PHP Services

Plesk's update article says: "If a service component is going to be updated, its service will be restarted." Still, confirm it, because a fix on disk does nothing until the processes that serve your sites restart. Plesk's article "How to restart PHP service in Plesk?" gives the interface route, Tools & Settings > Services Management, and a command-line route. First list the FPM handlers:

plesk bin php_handler --list | grep -E plesk.*fpm | awk -F" " '{ print $1 }'

Then restart each one by the name the list shows. Plesk's example name is service plesk-php71-fpm restart; on your server the names will match your installed versions. If a site uses PHP as an Apache module or through FastCGI, restart Apache as well. The full list of restart commands, by server type, is in our guide to restarting PHP workers after a security update.

Plesk for Windows

On Windows Server, Plesk lists fixed handlers for 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and the plesk-engine fix in the same 18.0.81 Update 4 and 18.0.80 Update 11. Its tables list no fixed builds for 8.1 or older on Windows. If a Windows site still runs an older handler, move it to a fixed version or plan to take it offline until you can. php.net's own Windows downloads also offer no 7.4, 8.0 or 8.1 binaries, because the PHP project's backports for those branches are source code only. Windows-specific details are in our guide to PHP2Shell on Windows and IIS.

Old PHP Versions on Plesk

The PHP project no longer releases 8.1 or older. PHP 8.1 reached end of life on 31 December 2025, 8.0 on 26 November 2023 and 7.4 on 28 November 2022. Plesk's backported Linux builds close PHP2Shell for those three, but they are a bridge, not a destination. PHP 8.2 itself reaches end of life on 31 December 2026, so move sites to 8.3 or newer.

For even older handlers, Plesk's advisory is direct: "for older versions of PHP (5.6, 7.2, 7.3) it is recommended to use paid TuxCare Extended Lifecycle Support for PHP." Plesk lists no fixed build of its own for those versions. Until a site moves, treat it as exposed. Test each move on a staging copy first, and keep a rollback plan.

Plesk's advisory covers the PHP that ships with Plesk. If you added a PHP build from another source, such as your operating system's own packages, update it through that source and check it the same way.

Upload Progress and Firewalls

On 23 October, PHP published an informational advisory for a third issue, CVE-2026-115560, which affects patched releases too. PHP suggests you "set session.upload_progress.enabled=0 until the next regular bugfix release." Applications that never change the session serializer at runtime "can keep the feature enabled," so this is a precaution, not an emergency. PHP says the setting must come from "php.ini, an FPM pool or server configuration that applies before request parsing," and warns: "Do not rely on ini_set() or FPM .user.ini." On Plesk, set it at the handler or server level, then restart that handler's service.

A web application firewall (WAF) can block known attack patterns, but it is not the fix. AWS calls its own WAF rules "a defense-in-depth control in this situation, not a replacement for the PHP upgrade." The other temporary measures, and what each can break, are in PHP2Shell interim mitigations.

Conclusion

On Plesk, PHP2Shell takes two fixes: updated PHP handlers for your sites and an updated sw-engine or plesk-engine for the panel. Run the Plesk update, confirm the product version is 18.0.81 Update 4 or 18.0.80 Update 11 or later, and check each handler. Use the version number for 8.2 to 8.5 and the 21 October 2026 build date for 7.4, 8.0 and 8.1. Restart the PHP services, confirm through a real web request, and move old sites to PHP 8.3 or newer. If you'd like help patching and verifying a Plesk server, our emergency PHP patching service can do it with you. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions