Release / Development

Plesk Obsidian: PHP 8.3 and enhanced WAF rules support

New micro-release; comes with PHP 8.3 handler support and updated Comodo/Atomicorp WAF rule sets.

Platform

Plesk

Version

Obsidian 18

Published

20 May 2026

Views

What's new

PHP 8.3 FastCGI/FPM handler official support
ModSecurity rule sets updated
Performance and accessibility improvements in the Panel interface

Per customer requests, the PHP 8.3 handler will be enabled first on staging servers.

Plesk — Related Advisories

VIEW ALL →

Plesk 14 Sep 2026

High · 8.7

CVE-2026-68489 — Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authentic

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

CVE-2026-68489 Vulnerability 24

Plesk 26 Aug 2026

High · 8.7

CVE-2026-65646 — Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files

Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges.

CVE-2026-65646 Vulnerability 24

Plesk 26 Aug 2026

High · 8.7

CVE-2026-65647 — Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as r

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.

CVE-2026-65647 Vulnerability 25