PHP2Shell statement record · Host
Status in the company's own words: patched partly. Statement dated Updated October 22, 2026 00:00 (changelog entries dated 21 October 2026).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on support.plesk.com, dated Updated October 22, 2026 00:00 (changelog entries dated 21 October 2026). Source type: official page.Fixes for EOL PHP versions 7.4.33, 8.0.30, 8.1.34 have the same version number, but different build date.
Fixes for EOL PHP versions 7.4.33, 8.0.30, 8.1.34 have the same version number, but different build date.
Versions built on 21 October 2026 have fixes included.
and The fix for sw-engine in Plesk Obsidian 18.0.80 is still pending.
(planned as 18.0.80 Update 11) quoted from the Plesk KB article (title: Vulnerability CVE-2026-109618 and CVE-2026-109619: Remote code execution in PHP shipped with Plesk). Plesk says it has rebuilt the PHP builds and delivers them to Plesk servers; administrators told to check PHP versions and build dates; PHP 5.6, 7.2, 7.3 pointed to TuxCare ELS. Changelog https://docs.plesk.com/release-notes/obsidian/change-log/ (21 October 2026): Updated PHP 8.5 to version 8.5.12. Updated PHP 8.4 to version 8.4.27.
(also 8.3.36, 8.2.35) and 18.0.81 Update 4 / 18.0.80 Update 11: Updated plesk-engine and sw-engine PHP to version 8.4.27.
No restart statement in the article.
differs
Yes—Plesk is affected, and patches are available as of October 23, 2026. Plesk confirms that both CVEs affect the PHP versions it ships, including the PHP engine used by the control panel itself, on Linux and Windows. Its current advisory was updated October 22, 2026. What has been patched? | Component | Fixed versions | |---|---| | Hosted-site PHP
differs
Yes, Plesk is confirmed to be affected by PHP2Shell, and patches have been issued. Here is a detailed breakdown: Is Plesk Affected by PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? Yes. Two security vulnerabilities were discovered in PHP, and as a result, all PHP versions shipped with Plesk are also affected. CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. The PHP security
no status named
Yes. Plesk was affected: Plesk states that all PHP versions shipped with Plesk for Linux and Windows were vulnerable to CVE-2026-109618 and CVE-2026-109619, which allow critical remote code execution. Patches are now available for most supported versions: PHP 8.5: 8.5.12 PHP 8.4: 8.4.27 PHP 8.3: 8.3.36 PHP 8.2: 8.2.35 PHP 8.1: 8.1.34 built on or after October 21, 2026
no status named
Yes, all PHP versions shipped with Plesk are affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and Plesk has been rolling out fixes and backported builds through its repositories. Status and Patch Details Impact: All PHP versions shipped or installed with Plesk are affected because the flaws exist in the core PHP runtime. Fixes Released: Official PHP fixes were
no status named
Yes, Plesk is affected by the PHP2Shell critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and Plesk has released patches for both the Plesk engine (sw-engine) and the PHP packages it ships. Patch and Impact Summary Plesk Core Engine (sw-engine / plesk-engine): Fixed in Plesk Obsidian 18.0.81 Update 4 and Plesk Obsidian 18.0.80 Update 11 (available for both Plesk for Linux and
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Plesk reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Plesk's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Plesk and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy