Back to Security Advisories

Security Advisory: Plesk PHP Updater Remote Code Execution

A remote code execution flaw in Plesk's PHP Updater component is fixed in this security release. Because the PHP Updater installs and switches PHP builds server-wide, code execution through it puts the entire web stack at risk, not a single site. Apply the Plesk micro-update on every server.

High
Plesk AlmaLinux 9 CloudLinux 9 Debian 12 Ubuntu 22.04

Affected Versions

Plesk Obsidian 18.0.63 and earlier

Patched Version

Plesk Obsidian 18.0.65

Default Update CMD

yum update -y

Fix Commands

AlmaLinux 9 / CloudLinux 9

plesk installer update --select-product-id plesk
plesk sbin packagemng --update

Ubuntu 22.04 / Debian 12

apt update
plesk installer update --select-product-id plesk

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a change in Plesk software, not in licensing. Apply it on every affected server: plesk installer --select-release-current --update-installed. Licenses keep working through updates; nothing needs re-issuing or re-activating.

What happened

Plesk‘s PHP Updater — the component that installs and manages alternate PHP versions — contained a flaw that allowed remote code execution. Compromise at this level runs with the updater’s privileges on the host, so the practical blast radius is the whole server: every website, database and mailbox it serves.

Who is affected

Plesk servers that use the PHP Updater component. Internet-exposed management surfaces are the primary concern, as with any RCE-class flaw in panel infrastructure.

How to apply the fix

  • Apply the micro-update: plesk installer --select-release-current --update-installed
  • Confirm the PHP Updater extension shows the patched version in Extensions.
  • Review server logs for unexpected updater activity before the patch window.

For SharedLicense customers

Your Plesk license is unaffected — this is Plesk software, not licensing. Run the micro-update; licenses keep working across the update.

Frequently Asked Questions

What is the Plesk PHP Updater flaw?
A remote code execution vulnerability in the component that installs and manages PHP versions server-wide.
How urgent is this update?
Treat it as urgent — RCE in panel infrastructure compromises every site the server hosts, not one account.
What is the update command?
plesk installer --select-release-current --update-installed, run on each Plesk server.

References

Security Advisories

Related Advisories

Linux Kernel (HWE) Vulnerabilities — Ubuntu Security Update (USN-9018-2)

2026-11-12

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System