Plesk PHP version: check it and install the PHP2Shell fix

Is Plesk affected by PHP2Shell?

Yes. Plesk says that all PHP versions shipped with Plesk are affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and so is sw-engine, the PHP engine that runs the Plesk interface itself. A site on Plesk stays affected until its PHP handler uses a fixed build. The upstream fixed releases are:

Plesk’s notice is the Knowledge Base article Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk.

How do I check the PHP version in Plesk?

Plesk shows the PHP version in three places:

1. Server-wide: log in to Plesk and go to Tools & Settings > PHP Settings. Plesk’s notice says the installed versions appear in the handler names.
2. Per domain: in Websites & Domains, the domain card shows the selected PHP version next to the PHP icon. On the domain’s PHP page you can open the phpinfo() page (Plesk: PHP Settings).
3. Over SSH (Linux): Plesk’s notice gives /opt/plesk/php/8.3/bin/php -v as the example for PHP 8.3. The output includes the build date, which matters for the EOL branches below.

To see which Plesk release you run, go to Home > System Overview or run plesk version (Plesk: How to install Plesk updates).

Did Plesk ship fixed PHP?

Yes. Plesk published its notice on 20 October 2026 and last updated it on 22 October 2026 (00:08 UTC when we checked). Plesk says it rebuilt its PHP 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 and 8.5 packages and delivers them to Plesk servers:

Plesk’s notice doesn’t list fixed builds of 7.4, 8.0 or 8.1 for Plesk for Windows. For PHP 5.6, 7.2 and 7.3, Plesk recommends paid TuxCare Extended Lifecycle Support.

How do I update PHP in Plesk?

Plesk delivers the fixed PHP builds as component updates. Plesk’s article How to install Plesk updates gives two ways:

1. In the interface: go to Tools & Settings, click Updates, then on the Updates and Upgrades page click Update Components and Continue.
2. Over SSH or RDP: run plesk installer update (on Windows, from a command prompt started as Administrator).

Plesk installs updates every night if Automatically install Plesk updates is on under Tools & Settings > Update Settings. Don’t wait for that run for PHP2Shell. To get the sw-engine fix as well, move to Plesk Obsidian 18.0.81 Update 4, as Plesk’s notice says. After updating, switch any domain still on PHP 5.6, 7.2 or 7.3 to a fixed branch in Websites & Domains > PHP.

How do I restart PHP and verify the fix in Plesk?

Plesk restarts a service when its component is updated, according to its update article: websites stay online, and Plesk itself may go offline for a few minutes. For a domain on the dedicated PHP-FPM handler, the domain’s PHP page also lets you start, stop or restart its PHP master process (Plesk: PHP Settings).

Then verify:

• Run the php -v check for each installed branch. For 8.2–8.5 the version must be the fixed release. For 7.4.33, 8.0.30 and 8.1.34 the build date must be 21 October 2026, because the number alone doesn’t change.
• Check what the website reports. In WordPress, go to Tools → Site Health → Info → Server (WordPress: Site Health).

What if I can’t update Plesk yet?

If you can’t install the update yet, apply PHP’s temporary settings at server level and restart PHP: see the PHP2Shell workaround page. Those settings reduce exposure but don’t fix PHP2Shell. When we checked, Plesk’s notice said it would add mitigation steps later and didn’t list any yet. A WAF in front of Plesk isn’t a fix either, because it filters only the traffic that passes through it, and PHP itself stays vulnerable.

What about old PHP 7.x on Plesk?

Plesk for Linux has patched builds of 7.4.33, but PHP 7.4 is end-of-life and gets no further upstream releases. Plesk has no fix for 5.6, 7.2 or 7.3 and points to paid TuxCare support. Move those sites to a supported branch: see PHP end of life.

After patching, use the PHP2Shell checker to read your version, follow the PHP2Shell patch guide, and check whether your site was hacked before the update landed.