PHP Security Vulnerability (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2)
- Type: Error
- Category: General
- Start: 2026-10-21T10:47:34+0000
- End: 2026-10-21T16:00:00+0000 (expected)
There are currently two critical vulnerabilities in PHP that affect all PHP versions without restriction. The PHP team is already planning a patch at 4 p.m. (CEST), but only for PHP versions 8.2 and higher. As things stand, older versions will remain unpatched. There is a temporary fix that limits the attack vector until the scheduled patch, but it does not fully resolve the problem.
What happened?
Two critical PHP vulnerabilities (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) were disclosed prematurely. As a result of the now publicly known PoC, every website using PHP is directly vulnerable. The vulnerability is a remote code execution in the PHP core that allows code to be executed on the remote server without significant prerequisites. Due to AI, it is expected that corresponding exploit tools will be developed and attacks launched later today.
What can be done now?
A preliminary patch has been released that mitigates part of the problem but does not fully resolve it. For this, "session.upload_progress.enabled = Off" must be set for all installed PHP versions. This must be set in all php.ini files (e.g. fpm, cli, apache2) or, with Plesk, in the respective php.d folder. Applications running on PHP versions below 8.2 should be updated immediately or temporarily shut down.
What needs to be done after the patch is released?
Once a patch has been released, the PHP version must be updated immediately, as this is the only way to fully resolve the problem. According to PHP, the fix is scheduled to be released at 4 p.m. Plesk has announced that it is working on a fix but has not yet given a release date.
What we are doing:
We are currently monitoring the situation internally and have taken appropriate measures. We therefore ask that you refrain from calling or opening tickets on this topic unless it is urgent, so that we can focus on resolving the situation. Of course, we remain available as usual.
What happened?
Two critical PHP vulnerabilities (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) were disclosed prematurely. As a result of the now publicly known PoC, every website using PHP is directly vulnerable. The vulnerability is a remote code execution in the PHP core that allows code to be executed on the remote server without significant prerequisites. Due to AI, it is expected that corresponding exploit tools will be developed and attacks launched later today.
What can be done now?
A preliminary patch has been released that mitigates part of the problem but does not fully resolve it. For this, "session.upload_progress.enabled = Off" must be set for all installed PHP versions. This must be set in all php.ini files (e.g. fpm, cli, apache2) or, with Plesk, in the respective php.d folder. Applications running on PHP versions below 8.2 should be updated immediately or temporarily shut down.
What needs to be done after the patch is released?
Once a patch has been released, the PHP version must be updated immediately, as this is the only way to fully resolve the problem. According to PHP, the fix is scheduled to be released at 4 p.m. Plesk has announced that it is working on a fix but has not yet given a release date.
What we are doing:
We are currently monitoring the situation internally and have taken appropriate measures. We therefore ask that you refrain from calling or opening tickets on this topic unless it is urgent, so that we can focus on resolving the situation. Of course, we remain available as usual.
Update: Update on the PHP Threat Situation
Due to the ongoing threat situation and attacks on live systems that have since been confirmed, we have temporarily deactivated our shared webspaces. No patch from the vendor is available yet, so unfortunately there is no alternative way to secure the systems. The temporary deactivation is therefore currently the only safe way to protect the customer data stored on the servers.
Email delivery to mailboxes hosted on the webspaces remains unaffected.
We are monitoring the situation closely and will reactivate the webspaces as soon as the patch is available and the security of the systems is ensured again. For urgent matters, you can reach us via ticket and phone.
Email delivery to mailboxes hosted on the webspaces remains unaffected.
We are monitoring the situation closely and will reactivate the webspaces as soon as the patch is available and the security of the systems is ensured again. For urgent matters, you can reach us via ticket and phone.
Update: PHP Releases First Fixes
Zwischenzeitlich hat PHP erste Fixes zur Verfügung gestellt, die aktuell nach und nach ausgerollt werden. Auch seitens Plesk sind bereits erste Fixes verfügbar, allerdings noch nicht für alle PHP-Versionen. Zudem sind die meisten Update-Mirrors derzeit stark überlastet.
Auch die Plesk Management Oberfläche selbst ist von der CVE betroffen. Für diese ist ein gesonderter Patch notwendig, welcher - stand jetzt - noch nicht verfügbar ist.
Auch die Plesk Management Oberfläche selbst ist von der CVE betroffen. Für diese ist ein gesonderter Patch notwendig, welcher - stand jetzt - noch nicht verfügbar ist.
Update: Plesk Update Server Overloaded
The Plesk update servers are currently completely overloaded and only sporadically accessible, which is why the rollout of security updates is unfortunately being further delayed.
Update: Plesk and Older Versions of PHP
Unfortunately, the Plesk update servers are still overloaded.
php.net has since confirmed that an update is also being provided for some end-of-life versions of PHP: 7.4, 8.0, and 8.1.
However, this update is not yet available via Plesk. Since quite a few pieces of content still rely on these outdated versions, the resolution of this issue continues to be delayed.
php.net has since confirmed that an update is also being provided for some end-of-life versions of PHP: 7.4, 8.0, and 8.1.
However, this update is not yet available via Plesk. Since quite a few pieces of content still rely on these outdated versions, the resolution of this issue continues to be delayed.
Update: Support and Hotline
Due to the current exceptional circumstances, we are extending our business hours today on an open-ended basis.
Our hotline also remains available as usual.
Our hotline also remains available as usual.
Update: Plesk & PHP Status Update
The hotfix for the Plesk interface itself is currently being distributed and should be available soon.
The fixes for PHP 7.4–8.1 via Plesk are still pending.
See: Plesk Forum
The fixes for PHP 7.4–8.1 via Plesk are still pending.
See: Plesk Forum
Update: PHP Update available
We just spoke with our account manager at Plesk, who informed us that the updates for 7.4, 8.0, and 8.1 are now available and can be rolled out.
Update: Rollout has begun
We can confirm that the updates are available and have begun rolling them out gradually across all systems.
The Plesk management interface itself is <b>not yet</b> available as an update.
Accordingly, we will leave it disabled for now and update it at a later date, once the update is available.
The Plesk management interface itself is <b>not yet</b> available as an update.
Accordingly, we will leave it disabled for now and update it at a later date, once the update is available.
Update: IPP Webspaces
The following systems have been updated:
Webhosting Webspaces
Wordpress Webspaces
Joomla Webspaces
Shop Webspaces
Reseller Webspaces
Webhosting Webspaces
Wordpress Webspaces
Joomla Webspaces
Shop Webspaces
Reseller Webspaces
Update: Plesk Panel
The update for the Plesk web interface is still pending. However, we have been informed that it will also be made available shortly.
Update: Managed Systems
We are currently patching all systems belonging to customers who have subscribed to a managed package.
Update: Plesk Panel
The update for the Plesk web interface is finally available. We'll move right on to the next round of updates.
Update: Completed
The updates have been successfully rolled out on our web hosting systems, as well as on all managed customer systems.
The regular hotline has been deactivated and switched back to the nighttime emergency hotline.
The management interface for our old V-Server environment is currently still deactivated for security reasons, as it was unfortunately no longer possible to complete its update and subsequent testing within the available timeframe. The functionality of the individual V-Servers is not affected by this.
The regular hotline has been deactivated and switched back to the nighttime emergency hotline.
The management interface for our old V-Server environment is currently still deactivated for security reasons, as it was unfortunately no longer possible to complete its update and subsequent testing within the available timeframe. The functionality of the individual V-Servers is not affected by this.
Update: Old vServer Panel
The updates to the old vServer Panel ([url=https://v-server.ip-projects.de]v-server.ip-projects.de[/url]) have also been successfully completed, and the panel is available again.