Is PHP2Shell fixed on Plesk (Linux)?

Status as of October 26, 2026: Reported by Plesk; not confirmed in a second primary source as of October 26, 2026.

The short answer

Stated in one source only, so not confirmed as of October 26, 2026: Plesk PHP 8.2 to 8.5: 8.5.12, 8.4.27, 8.3.36, 8.2.35; Plesk PHP 8.1, 8.0 and 7.4 (end of life), Linux: Fix backported to 8.1.34, 8.0.30 and 7.4.33; Plesk’s own engine PHP: 8.4.27 in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11. A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on Plesk

How to check on Plesk (read-only)

Run these on the server. They only read versions, package data, the process list and configuration files. Package and path names can differ by Plesk version; check them against your server.

# 1. Plesk version and the PHP handlers it manages
plesk version
plesk bin php_handler --list

# 2. Installed Plesk PHP packages
if command -v dpkg-query >/dev/null 2>&1; then dpkg -l 'plesk-php*'; else rpm -qa 'plesk-php*'; fi

# 3. RPM-based servers: does the package changelog name both CVEs? Replace XY with each version you use, e.g. 81 for PHP 8.1
rpm -q --changelog plesk-phpXY | grep -E 'CVE-2026-1096(18|19)'
# No match doesn't mean unpatched: compare the installed version with the fixed build above

# 4. When did each PHP-FPM master start? It must be after the update
ps -eo pid,lstart,args | grep '[p]hp-fpm: master'

# 5. CVE-2026-115560: is the setting in the configuration files?
# Plesk keeps per-site PHP settings under /var/www/vhosts/system/<domain>/etc/
grep -rns 'session.upload_progress.enabled' /opt/plesk/php/*/etc/ /var/www/vhosts/system/*/etc/ 2>/dev/null

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On Plesk: The part of Plesk’s change log we read doesn’t mention CVE-2026-115560 or session upload progress.

Notes for Plesk

• For 8.1, 8.0 and 7.4, the fixed builds keep the old version numbers (8.1.34, 8.0.30, 7.4.33), so the version alone can’t tell you whether you have the backport (source: AlmaLinux).
• We read Plesk’s change log entry only. That entry doesn’t mention Plesk’s Windows PHP.

Sources (checked October 26, 2026)

• Plesk: Plesk Obsidian change log: PHP Updates. Page date: Oct 21, 2026. States: PHP updated to 8.5.12, 8.4.27, 8.3.36, 8.2.35; on Linux, the fix backported to 8.1.34, 8.0.30 and 7.4.33 (EOL); plesk-engine and sw-engine PHP updated to 8.4.27 in 18.0.81 Update 4 and 18.0.80 Update 11.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

cPanel EasyApache 4 (ea-php) · CloudLinux alt-php · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.