Plesk Obsidian on Linux and Windows

How to update PHP in Plesk, domain by domain

In Plesk, go to Websites & Domains, click PHP on the domain, choose a version and a handler, then click OK. The versions offered are usually Plesk's own PHP components, kept current by the server administrator. Plesk shipped fixed builds for PHP2Shell on 21 October 2026, but a server only has them once those component updates are installed.

Last reviewed against php.net and Plesk's documentation and change log.

Who does what

Your Plesk role sets how far you can go

The same PHP page looks different depending on who logs in. Find yourself below, then follow the matching section.

3D laptop on building blocks, for a website owner choosing PHP settings

Website owner

You log in to manage your own sites

You choose the version and handler for each domain, within whatever your subscription allows. Missing versions and patching are your provider's job.

3D server and monitor downloading updates, for a Plesk administrator

Server administrator

You run the Plesk server

You install PHP versions as components, decide whether Plesk updates them for you, and control which version and handler combinations customers can pick.

3D group of users around a secured server, for service plans that set PHP

Reseller

You sell hosting through service plans

Your plans set the PHP settings your customers inherit, including the FPM handler type, served by Apache or by nginx. The server's PHP builds still come from its administrator.

3D network of laptops and servers, for Plesk on a Windows server

Plesk for Windows

Your Plesk server runs Windows

PHP versions are installed under Plesk hosting features, and Plesk recommends the FastCGI application handler there. Its Windows PHP moved to the -1 builds on 27 October.

What Plesk shipped for PHP2Shell

From the "PHP Updates" entries in the Plesk Obsidian change log.

Date Platform Change
21 October 2026 Not limited to one platform PHP 8.5 to 8.5.12, 8.4 to 8.4.27, 8.3 to 8.3.36, 8.2 to 8.2.35
21 October 2026 Linux Fix for CVE-2026-109618 and CVE-2026-109619 backported into the end-of-life 8.1.34, 8.0.30 and 7.4.33 builds (version numbers unchanged)
27 October 2026 Windows PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, the same version labels as the PHP project's 26 October Windows rebuilds

Source: Change Log for Plesk Obsidian. For what the -1 Windows packages change, see updating PHP on Windows and IIS.

For website owners

Change the PHP version for one domain

Plesk keeps PHP settings per domain, so a change here touches one website. Note the current version and handler first; switching back is the same three clicks.

  1. Step 1

    Find the domain

    Log in to Plesk and open Websites & Domains. The domain's card already shows its PHP version beside the PHP icon; no version there means PHP is not enabled for that domain.

  2. Step 2

    Open its PHP settings

    Click PHP. In Plesk's newer site view it sits under Dev Tools on the site's Dashboard tab.

  3. Step 3

    Make sure PHP support is on

    If the PHP support checkbox is clear, select it.

  4. Step 4

    Choose the version

    Pick it from the drop-down menu. Prefer PHP 8.3 or later: 8.2 is supported only until 31 December 2026, and the PHP project no longer releases 8.1 or older. If the version you want is not offered, your hosting provider has to install it or make it available.

  5. Step 5

    Choose the handler

    The handlers on offer depend on the PHP version and the server's operating system. The handler table below explains the options.

  6. Step 6

    Click OK, then check

    The change takes effect shortly. Use View the phpinfo() page on the same screen to read the exact release, as described in confirm it worked.

Inheritance. Domains take their PHP settings from the subscription and subdomains from their parent domain, so check subdomains such as a staging copy separately if they have been given their own settings.

Moving branch. Plesk warns that code written for one PHP version may not run on another. A patch release on your branch is a safe update; a new branch is a change to test. WordPress owners can follow the WordPress testing steps.

PHP handlers

FPM served by nginx, FPM served by Apache, or FastCGI

The handler decides which process runs PHP for the site and which web server hands it requests. It affects .htaccess support, memory use and how isolated each site is.

Handler (as Plesk names it) Where What to know
FPM application served by nginx Linux PHP-FPM behind nginx. Handlers served by nginx ignore .htaccess files, so rules kept there stop working unless converted.
FPM application served by Apache Linux PHP-FPM behind Apache, so .htaccess rules still apply. Apache-served handlers need Proxy mode ticked in Apache & nginx Settings. All sites on the same PHP version share one pool; Plesk recommends this for dedicated servers.
Dedicated FPM application Linux Each site gets its own PHP master process and pool, served by Apache or nginx. Needs PHP 7.3 or later and uses more OPcache memory. Plesk recommends it for shared hosting servers.
FastCGI application Linux and Windows Always served by Apache on Linux. Plesk's recommended handler on Windows servers.
mod_php served by Apache, CGI application, ISAPI module Older setups Plesk describes these as severely outdated and/or insecure. CGI is unavailable to customers by default.

Handlers and PHP2Shell. php.net lists PHP-FPM, Apache with mod_php and php-cgi among the affected setups and rates mod_php the highest risk. Moving a site off the mod_php handler is worthwhile, but every handler needs the fixed PHP release underneath it. More on PHP-FPM.

Restarting a single site. With the Dedicated FPM handler, each site's PHP master process can be started, stopped or restarted from its PHP page without touching any other site. That is the quickest way to make one site pick up a new build.

For Plesk administrators

Install and update PHP versions on the server

Plesk installs PHP as components and sets up the CGI, FastCGI and PHP-FPM handlers for each version automatically. Patching means applying component updates, which Plesk does not do by default.

1. Install the component updates now

# Install every available update for this Plesk version, PHP included
plesk installer --select-release-latest --upgrade-installed-components

# Tell Plesk to re-read its PHP handlers after the binaries change
plesk bin php_handler --reread

# List the PHP handlers Plesk has registered
plesk bin php_handler --list

The first command installs all updates available for your current Plesk version, including PHP. Plesk's lighter plesk installer install-panel-updates updates Plesk alone and leaves PHP as it is unless Plesk needs the change. Run --reread after the PHP binaries change so Plesk's handler records match them.

2. Decide whether Plesk should do this for you

Open Tools & Settings > Update Settings and look for Automatically install updates for third-party components shipped by Plesk, an option on Plesk for Linux. It is off by default because a newer component can break existing sites. Plesk checks for updates once a day, so with it on, security releases such as these arrive without anyone logging in.

3. Add or remove a whole PHP version

Go to Tools & Settings > Updates and click Add/Remove Components. On Linux, expand Web hosting and then PHP interpreter versions; on Windows, expand Plesk hosting features. Installed versions show a green tick and missing ones a red cross: click the icon, choose Install or Remove, then click Continue.

4. Find the domains still on old branches

Tools & Settings > PHP Settings lists every PHP version and handler combination on the server, with the number of domains using each one beside its name. Click a combination's availability icon to stop customers choosing it; make every handler of a version unavailable and the version disappears from their menus.

5. Make each site load the new build

Check each site's phpinfo() page after the update. If one still reports the old release, restart its PHP: from its PHP page for Dedicated FPM, or by restarting the PHP-FPM service for that version on the server. Plesk's own interface runs on a separate PHP build, which Plesk updated to 8.4.27 on 21 October 2026 through its normal product updates.

Confirm it worked

Confirm each site is on a fixed release

The domain card shows the branch Plesk has selected. These checks show the release actually serving requests.

Check 1

The domain's phpinfo() page

On the domain's PHP page, click View the phpinfo() page. It shows the settings in force for that domain, server-level ones included, with the PHP version at the top. Look for 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later.

Check 2

The end-of-life builds

For 8.1.34, 8.0.30 and 7.4.33 the number is the same before and after Plesk's backport, so phpinfo() cannot settle it. Confirm the 21 October component updates are installed, and move those sites to a supported branch.

Check 3

From outside the panel

WordPress's Site Health screen reads the same number from inside the site. Other methods are on how to check your PHP version.

Patched a site that was public while it ran a vulnerable build? CISA has listed both flaws as exploited in the wild since 26 October 2026, so look for signs of compromise too: has your PHP site been compromised? For a site that has to wait for its fix, weigh up whether it should stay online.

Troubleshooting

Common Plesk PHP problems and their fixes

The version you need is not in the menu

It is not installed on the server, or the administrator has made it unavailable to customers. Ask your hosting provider; administrators add versions through Add/Remove Components.

No Apache-served handlers appear

They need the Proxy mode checkbox ticked on the domain's Apache & nginx Settings page. Without it, only nginx-served handlers are offered.

Redirects or access rules broke after a handler change

nginx-served handlers ignore .htaccess. Move back to an Apache-served handler, or convert the rules to nginx format.

The PHP page is read-only, or some settings are missing

Your subscription limits which PHP settings you can manage. Settings you cannot reach have to be changed by your hosting provider.

Plesk updated itself but PHP stayed on the old release

Updates to third-party components, PHP among them, are off by default, and plesk installer install-panel-updates leaves PHP alone unless Plesk itself needs it. Install the component updates.

The site broke after moving to another PHP version

Code written for one PHP branch can fail on another, as Plesk's own documentation cautions. Pick the previous version on the same PHP page and click OK, then fix the code before trying again.

The site became slow after changing PHP-FPM settings

Plesk's advice is to reset all PHP settings for the domain to their defaults, then change one thing at a time.

phpinfo() still reports the old release after an update

Run plesk bin php_handler --reread so Plesk picks up the new binaries, then restart the site's PHP. Dedicated FPM sites have start, stop and restart controls on their PHP page.

On a different panel? Read the cPanel and WHM guide, the shared hosting guide if your host manages PHP, or every update route.

Quick answers

Plesk and PHP: questions, answered

Does Plesk update PHP automatically?

Not unless the administrator has chosen it. Plesk counts PHP as a third-party component, and automatic installation of third-party component updates starts switched off, because a newer component can break sites. Plesk checks for updates once a day; with the option off, the administrator installs PHP updates by hand.

Has Plesk shipped the PHP2Shell fixes?

Yes. The Plesk Obsidian change log records PHP updates on 21 October 2026 to 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and on Linux backports of the fix into its 8.1.34, 8.0.30 and 7.4.33 builds. On 27 October it updated the Windows builds to the PHP project's -1 packages. A server has them only once the component updates are installed.

The fixed versions explained

Which PHP handler should I choose in Plesk?

On Linux, one of the FPM handlers: Plesk recommends Dedicated FPM application for shared hosting and FPM application for dedicated servers. On Windows, FastCGI application. Choose served by Apache if the site relies on .htaccess rules. The handler does not fix PHP2Shell on its own; the PHP project lists PHP-FPM, mod_php and CGI setups as affected, so the version must be fixed whatever runs it.

My domain shows PHP 8.1. Is it fixed?

Only if the server has Plesk's 21 October backport installed, and the number will not tell you, because the build stays 8.1.34 either way. Ask your provider whether the component updates from that date are installed. Then plan the move: the PHP project no longer supports 8.1, and PHP 8.2 reaches end of life on 31 December 2026.

PHP end of life dates

Does the Plesk control panel run on PHP too?

Yes, on its own PHP build, separate from the versions your sites use. Plesk updated that build (plesk-engine and sw-engine PHP) to 8.4.27 in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11, both on 21 October 2026. Those are Plesk updates, which the separate setting for automatic Plesk updates covers.

Can every domain in Plesk run a different PHP version?

Yes. Each domain and subdomain can have its own version and handler if the subscription allows it. By default domains inherit PHP settings from their subscription, and subdomains from their parent domain.

3D rocket illustration above the call to find every exposed PHP server

Know your exposure

Find every PHP server you run

Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.