Fix guides / Plesk
Fix php2shell on Plesk
Plesk ships its own PHP builds under /opt/plesk/php, one per version, and they follow upstream numbering: they need 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later. Update them with Plesk Installer, then restart each PHP-FPM service.
These steps fix CVE-2026-109618 and CVE-2026-109619. Upstream releases and distribution package numbers are in the fixed versions table.
Can’t update right now? Apply the temporary mitigations.
Not sure which PHP your site uses? Start with the self-check.
1. Find every PHP handler
List PHP handlers and versions:
plesk bin php_handler --listVersion of every Plesk PHP build:
for p in /opt/plesk/php/*/bin/php; do echo "$p: $($p -r "echo PHP_VERSION;")"; done2. Install the update
In the panel: Tools & Settings → Updates, then install the available component updates. Or from the command line:
plesk installer --select-release-current --upgrade-installed-componentsDomains on PHP 8.1 or older: switch them to 8.2 or later in Websites & Domains → PHP.
3. Restart PHP
Each Plesk PHP version has its own FPM service (replace 83):
sudo systemctl restart plesk-php83-fpmApache (Debian/Ubuntu: apache2, RHEL family: httpd):
sudo systemctl restart apache24. Verify
Run the version loop from step 1 again, then confirm the version your website really uses with the temporary file from the self-check page.