Plesk Obsidian on Linux and Windows
How to update PHP in Plesk, domain by domain
In Plesk, go to Websites & Domains, click PHP on the domain, choose a version and a handler, then click OK. The versions offered are usually Plesk's own PHP components, kept current by the server administrator. Plesk shipped fixed builds for PHP2Shell on 21 October 2026, but a server only has them once those component updates are installed.
Last reviewed against php.net and Plesk's documentation and change log.
Who does what
Your Plesk role sets how far you can go
The same PHP page looks different depending on who logs in. Find yourself below, then follow the matching section.
Website owner
You log in to manage your own sites
You choose the version and handler for each domain, within whatever your subscription allows. Missing versions and patching are your provider's job.
Server administrator
You run the Plesk server
You install PHP versions as components, decide whether Plesk updates them for you, and control which version and handler combinations customers can pick.
Reseller
You sell hosting through service plans
Your plans set the PHP settings your customers inherit, including the FPM handler type, served by Apache or by nginx. The server's PHP builds still come from its administrator.
Plesk for Windows
Your Plesk server runs Windows
PHP versions are installed under Plesk hosting features, and Plesk recommends the FastCGI application handler there. Its Windows PHP moved to the -1 builds on 27 October.
What Plesk shipped for PHP2Shell
From the "PHP Updates" entries in the Plesk Obsidian change log.
| Date | Platform | Change |
|---|---|---|
| 21 October 2026 | Not limited to one platform | PHP 8.5 to 8.5.12, 8.4 to 8.4.27, 8.3 to 8.3.36, 8.2 to 8.2.35 |
| 21 October 2026 | Linux | Fix for CVE-2026-109618 and CVE-2026-109619 backported into the end-of-life 8.1.34, 8.0.30 and 7.4.33 builds (version numbers unchanged) |
| 27 October 2026 | Windows | PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, the same version labels as the PHP project's 26 October Windows rebuilds |
Source: Change Log for Plesk Obsidian. For what the -1 Windows packages change, see updating PHP on Windows and IIS.
For website owners
Change the PHP version for one domain
Plesk keeps PHP settings per domain, so a change here touches one website. Note the current version and handler first; switching back is the same three clicks.
-
Step 1
Find the domain
Log in to Plesk and open Websites & Domains. The domain's card already shows its PHP version beside the PHP icon; no version there means PHP is not enabled for that domain.
-
Step 2
Open its PHP settings
Click PHP. In Plesk's newer site view it sits under Dev Tools on the site's Dashboard tab.
-
Step 3
Make sure PHP support is on
If the PHP support checkbox is clear, select it.
-
Step 4
Choose the version
Pick it from the drop-down menu. Prefer PHP 8.3 or later: 8.2 is supported only until 31 December 2026, and the PHP project no longer releases 8.1 or older. If the version you want is not offered, your hosting provider has to install it or make it available.
-
Step 5
Choose the handler
The handlers on offer depend on the PHP version and the server's operating system. The handler table below explains the options.
-
Step 6
Click OK, then check
The change takes effect shortly. Use View the phpinfo() page on the same screen to read the exact release, as described in confirm it worked.
Inheritance. Domains take their PHP settings from the subscription and subdomains from their parent domain, so check subdomains such as a staging copy separately if they have been given their own settings.
Moving branch. Plesk warns that code written for one PHP version may not run on another. A patch release on your branch is a safe update; a new branch is a change to test. WordPress owners can follow the WordPress testing steps.
PHP handlers
FPM served by nginx, FPM served by Apache, or FastCGI
The handler decides which process runs PHP for the site and which web server hands it requests. It affects .htaccess support, memory use and how isolated each site is.
| Handler (as Plesk names it) | Where | What to know |
|---|---|---|
| FPM application served by nginx | Linux | PHP-FPM behind nginx. Handlers served by nginx ignore .htaccess files, so rules kept there stop working unless converted. |
| FPM application served by Apache | Linux | PHP-FPM behind Apache, so .htaccess rules still apply. Apache-served handlers need Proxy mode ticked in Apache & nginx Settings. All sites on the same PHP version share one pool; Plesk recommends this for dedicated servers. |
| Dedicated FPM application | Linux | Each site gets its own PHP master process and pool, served by Apache or nginx. Needs PHP 7.3 or later and uses more OPcache memory. Plesk recommends it for shared hosting servers. |
| FastCGI application | Linux and Windows | Always served by Apache on Linux. Plesk's recommended handler on Windows servers. |
| mod_php served by Apache, CGI application, ISAPI module | Older setups | Plesk describes these as severely outdated and/or insecure. CGI is unavailable to customers by default. |
Handlers and PHP2Shell. php.net lists PHP-FPM, Apache with mod_php and php-cgi among the affected setups and rates mod_php the highest risk. Moving a site off the mod_php handler is worthwhile, but every handler needs the fixed PHP release underneath it. More on PHP-FPM.
Restarting a single site. With the Dedicated FPM handler, each site's PHP master process can be started, stopped or restarted from its PHP page without touching any other site. That is the quickest way to make one site pick up a new build.
For Plesk administrators
Install and update PHP versions on the server
Plesk installs PHP as components and sets up the CGI, FastCGI and PHP-FPM handlers for each version automatically. Patching means applying component updates, which Plesk does not do by default.
1. Install the component updates now
# Install every available update for this Plesk version, PHP included
plesk installer --select-release-latest --upgrade-installed-components
# Tell Plesk to re-read its PHP handlers after the binaries change
plesk bin php_handler --reread
# List the PHP handlers Plesk has registered
plesk bin php_handler --list
The first command installs all updates available for your current
Plesk version, including PHP. Plesk's lighter
plesk installer install-panel-updates
updates Plesk alone and leaves PHP as it is unless Plesk needs the
change. Run --reread after the PHP
binaries change so Plesk's handler records match them.
2. Decide whether Plesk should do this for you
Open Tools & Settings > Update Settings and look for Automatically install updates for third-party components shipped by Plesk, an option on Plesk for Linux. It is off by default because a newer component can break existing sites. Plesk checks for updates once a day, so with it on, security releases such as these arrive without anyone logging in.
3. Add or remove a whole PHP version
Go to Tools & Settings > Updates and click Add/Remove Components. On Linux, expand Web hosting and then PHP interpreter versions; on Windows, expand Plesk hosting features. Installed versions show a green tick and missing ones a red cross: click the icon, choose Install or Remove, then click Continue.
4. Find the domains still on old branches
Tools & Settings > PHP Settings lists every PHP version and handler combination on the server, with the number of domains using each one beside its name. Click a combination's availability icon to stop customers choosing it; make every handler of a version unavailable and the version disappears from their menus.
5. Make each site load the new build
Check each site's phpinfo() page after the update. If one still reports the old release, restart its PHP: from its PHP page for Dedicated FPM, or by restarting the PHP-FPM service for that version on the server. Plesk's own interface runs on a separate PHP build, which Plesk updated to 8.4.27 on 21 October 2026 through its normal product updates.
Confirm it worked
Confirm each site is on a fixed release
The domain card shows the branch Plesk has selected. These checks show the release actually serving requests.
Check 1
The domain's phpinfo() page
On the domain's PHP page, click View the phpinfo() page. It shows the settings in force for that domain, server-level ones included, with the PHP version at the top. Look for 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later.
Check 2
The end-of-life builds
For 8.1.34, 8.0.30 and 7.4.33 the number is the same before and after Plesk's backport, so phpinfo() cannot settle it. Confirm the 21 October component updates are installed, and move those sites to a supported branch.
Check 3
From outside the panel
WordPress's Site Health screen reads the same number from inside the site. Other methods are on how to check your PHP version.
Patched a site that was public while it ran a vulnerable build? CISA has listed both flaws as exploited in the wild since 26 October 2026, so look for signs of compromise too: has your PHP site been compromised? For a site that has to wait for its fix, weigh up whether it should stay online.
Troubleshooting
Common Plesk PHP problems and their fixes
The version you need is not in the menu
It is not installed on the server, or the administrator has made it unavailable to customers. Ask your hosting provider; administrators add versions through Add/Remove Components.
No Apache-served handlers appear
They need the Proxy mode checkbox ticked on the domain's Apache & nginx Settings page. Without it, only nginx-served handlers are offered.
Redirects or access rules broke after a handler change
nginx-served handlers ignore .htaccess. Move back to an Apache-served handler, or convert the rules to nginx format.
The PHP page is read-only, or some settings are missing
Your subscription limits which PHP settings you can manage. Settings you cannot reach have to be changed by your hosting provider.
Plesk updated itself but PHP stayed on the old release
Updates to third-party components, PHP among them, are off by default, and plesk installer install-panel-updates leaves PHP alone unless Plesk itself needs it. Install the component updates.
The site broke after moving to another PHP version
Code written for one PHP branch can fail on another, as Plesk's own documentation cautions. Pick the previous version on the same PHP page and click OK, then fix the code before trying again.
The site became slow after changing PHP-FPM settings
Plesk's advice is to reset all PHP settings for the domain to their defaults, then change one thing at a time.
phpinfo() still reports the old release after an update
Run plesk bin php_handler --reread so Plesk picks up the new binaries, then restart the site's PHP. Dedicated FPM sites have start, stop and restart controls on their PHP page.
On a different panel? Read the cPanel and WHM guide, the shared hosting guide if your host manages PHP, or every update route.
Quick answers
Plesk and PHP: questions, answered
Does Plesk update PHP automatically?
Not unless the administrator has chosen it. Plesk counts PHP as a third-party component, and automatic installation of third-party component updates starts switched off, because a newer component can break sites. Plesk checks for updates once a day; with the option off, the administrator installs PHP updates by hand.
Has Plesk shipped the PHP2Shell fixes?
Yes. The Plesk Obsidian change log records PHP updates on 21 October 2026 to 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and on Linux backports of the fix into its 8.1.34, 8.0.30 and 7.4.33 builds. On 27 October it updated the Windows builds to the PHP project's -1 packages. A server has them only once the component updates are installed.
Which PHP handler should I choose in Plesk?
On Linux, one of the FPM handlers: Plesk recommends Dedicated FPM application for shared hosting and FPM application for dedicated servers. On Windows, FastCGI application. Choose served by Apache if the site relies on .htaccess rules. The handler does not fix PHP2Shell on its own; the PHP project lists PHP-FPM, mod_php and CGI setups as affected, so the version must be fixed whatever runs it.
My domain shows PHP 8.1. Is it fixed?
Only if the server has Plesk's 21 October backport installed, and the number will not tell you, because the build stays 8.1.34 either way. Ask your provider whether the component updates from that date are installed. Then plan the move: the PHP project no longer supports 8.1, and PHP 8.2 reaches end of life on 31 December 2026.
Does the Plesk control panel run on PHP too?
Yes, on its own PHP build, separate from the versions your sites use. Plesk updated that build (plesk-engine and sw-engine PHP) to 8.4.27 in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11, both on 21 October 2026. Those are Plesk updates, which the separate setting for automatic Plesk updates covers.
Can every domain in Plesk run a different PHP version?
Yes. Each domain and subdomain can have its own version and handler if the subscription allows it. By default domains inherit PHP settings from their subscription, and subdomains from their parent domain.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.