PHP2Shell on Plesk: Patching and Verification Runbook

Why Plesk Servers Are in Scope

Plesk ships and manages PHP runtimes used by hosted applications. Because CVE-2026-109618 and CVE-2026-109619 affect PHP request handling, those Plesk-provided handlers inherit the vulnerability until the fixed packages are installed.

Plesk for Linux: Affected and Patched PHP Builds

Plesk recommends paid TuxCare Extended Lifecycle Support for PHP for older PHP 5.6, 7.2, and 7.3 deployments. The safer strategic outcome is still to remove unsupported application dependencies and move to a supported PHP branch.

Plesk for Windows: Affected and Patched PHP Builds

Use Tools & Settings > PHP Settings to confirm installed handlers and their names, then verify that every handler assigned to a subscription is on a fixed version.

Plesk sw-engine Affected and Fixed Updates

The sw-engine component is the PHP engine used by Plesk itself. The same fixed update levels apply to Plesk for Linux and Plesk for Windows.

Pre-Update Inventory and Safety Checks

1. Record the current Plesk buildCapture the exact branch, update number, operating system, and build date before changing anything.
2. List installed and assigned PHP handlersMap each handler to subscriptions and note the SAPI in use, including PHP-FPM, FastCGI, or Apache module deployments.
3. Prioritize internet-facing applicationsStart with public services, especially Apache mod_php, administrative applications, upload endpoints, and high-value data stores.
4. Prepare recoveryConfirm current backups, snapshots where appropriate, application owners, maintenance window, rollback criteria, and console access.
5. Collect a health baselineRecord HTTP checks, background jobs, PHP extensions, database connectivity, and representative application transactions.
6. Use the supported updaterFollow Plesk's official update process and install the latest available Plesk version rather than downloading PHP packages from an untrusted source.

Official procedure: How to install Plesk updates.

Version Verification Commands

Run read-only checks from an authorized administrative session. Replace the example PHP branch with every installed version in active use.

# plesk version
Product version: Plesk Obsidian 18.0.81.4
OS version: your installed operating system
Build date: 2026/10/21 ...

# plesk bin php_handler --list
                 id:  plesk-php83-fpm
        display name:  8.3.36
             version:  8.3.36
                type:  fpm

# /opt/plesk/php/8.3/bin/php -v
PHP 8.3.36 (cli) (built: Oct 21 2026 08:04:57) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.36, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.36, Copyright (c), by Zend Technologies

$ php -v
PHP x.y.z (cli) (built: ...)

Verify PHP Versions in the Plesk Interface

1. Log in through the authorized administration pathUse the server hostname over HTTPS and your approved Plesk administrator account.
2. Open Tools & Settings > PHP SettingsReview every installed handler. Versions should be reflected in the handler names and details.
3. Check subscription assignmentsConfirm which websites use each handler so an older runtime is not overlooked simply because it is not the server default.
4. Confirm the Plesk buildOpen Tools & Settings > About Plesk and record the full version/update level.
5. Retain evidenceSave the change record, version output, package/build details, restart time, and application validation results.

For official navigation and login options, use Plesk's login guide and version-check guide.

Post-Update Validation and Monitoring

• Recycle runtime processes: follow Plesk's updater and service guidance so web-server and PHP workers load patched binaries.
• Verify each handler again: compare actual output with the fixed-version table and retain build dates for EOL backports.
• Test representative applications: validate login, uploads, scheduled tasks, APIs, payment or form flows, and PHP extensions.
• Check Plesk UI health: confirm administrative pages, subscriptions, extensions, and background tasks operate normally after the sw-engine update.
• Review telemetry: inspect web access/error logs, PHP logs, WAF and EDR alerts, new processes, unusual child processes, outbound connections, and unexpected file changes.
• Treat anomalies as an incident: isolate affected systems, preserve evidence, rotate exposed credentials and secrets, and follow the organization's incident-response plan.

Official Sources and Next Checks

• Plesk vulnerability advisory — the source of the Plesk PHP and sw-engine version tables.
• PHP security advisory — upstream fixed releases and the statement that updating is the only complete solution.
• Plesk update procedure — supported installation paths for Plesk updates.
• Plesk version verification — UI and CLI methods for checking the installed build.

If you need the threat model before using this runbook, return to Part 1: PHP2Shell explained.

Plesk PHP2Shell Patching Frequently Asked Questions