Plesk PHP2Shell fixes: check the panel and each website

Check the panel’s own PHP engine

Plesk’s October 21 release notes list Obsidian 18.0.81 Update 4 and 18.0.80 Update 11. Both update the panel’s sw-engine and plesk-engine PHP to 8.4.27. These are panel updates, separate from choosing a website’s PHP version.

Record the complete installed update. Plesk’s version-check instructions show Tools & Settings → About Plesk. An administrator can also run this on a Plesk server they manage:

plesk version

This reads Plesk version information. Keep its product version and build details with the update record. If your account does not show them, ask the hosting provider for the full installed Plesk update.

Match website PHP to Plesk’s notice

The Plesk security notice, updated October 22, lists these website PHP releases for both Linux and Windows:

Scroll sideways to see all columns.

For Plesk on Linux, the notice also lists fixes in 7.4.33, 8.0.30 and 8.1.34 builds dated October 21. Their displayed version numbers stayed the same. Record the build date as well as the number. Plesk labels these branches end of life; this specific backport does not provide a future maintenance plan.

In Tools & Settings → PHP Settings, check the installed handlers. For an administrator checking the Plesk PHP 8.3 executable on Linux, the notice gives this command:

/opt/plesk/php/8.3/bin/php -v

Use the path for the branch you are checking. It reports that command-line executable, so also identify the handler serving the website. These version entries concern the original two PHP2Shell flaws. Review PHP’s separate October 23 session advice too.

Check the PHP selected for every domain

Plesk’s PHP Settings documentation explains that individual domains can use different PHP versions and handlers. In Websites & Domains, open the domain’s PHP page and record the selected version and handler. A handler is the way the web server runs PHP.

Include subdomains that run PHP. Plesk allows their settings to differ from their parent domain. If the relevant setting is hidden or a required version is unavailable, the documentation directs customers to their hosting provider.

Keep the existing selection while checking the installed fix. Moving a website to another PHP branch is an application compatibility change and needs its own testing. If a site is using a PHP build supplied outside Plesk, ask that supplier which package contains the fix.

Install through Plesk, then test the websites

For an authorized administrator, Plesk’s update instructions use Tools & Settings → Updates → Update Components. They warn that the panel may be unavailable for several minutes and that an updated service component will restart. Plan access and application checks around the components being changed.

After the update, record the panel update and website PHP builds again. Test sign-in, form submission and uploads on staging. Test store checkout in isolated staging with the payment provider’s test mode. If a task fails, preserve its time, URL and relevant error message for the administrator.

A useful host reply names the installed panel update, the fixed PHP build and the handler assigned to each affected domain. Ask the administrator to confirm that new website requests reach the updated PHP workers. For a WordPress store, use the post-update website checks to record which customer tasks passed.