Servers Australia Incident History

1. identifiedOct 23 · 00:20 UTC

   Critical PHP Security Vulnerabilities – Plesk Security Update

   The PHP project released security updates on 21 October 2026 addressing two vulnerabilities, both rated Critical.

   As Plesk includes and uses PHP, these vulnerabilities may affect Plesk installations.

   These vulnerabilities are within PHP itself and are not vulnerabilities in the Plesk application code.
   Identified Vulnerabilities:

   • CVE-2026-109618
     
   • CVE-2026-109619
     

   Affected and Patched Product Versions

   PHP on Plesk Obsidian for Linux
   PHP 8.5
   Affected: 8.5.11 and below Patched: 8.5.12
   PHP 8.4
   Affected: 8.4.26 and below Patched: 8.4.27
   PHP 8.3
   Affected: 8.3.35 and below Patched: 8.3.36
   PHP 8.2
   Affected: 8.2.34 and below Patched: 8.2.35
   PHP 8.1 (End of Life)
   Affected: 8.1.34 (built before 21 October 2026) Patched: 8.1.34 (built on 21 October 2026)
   PHP 8.0 (End of Life)
   Affected: 8.0.30 (built before 21 October 2026) Patched: 8.0.30 (built on 21 October 2026)
   PHP 7.4 (End of Life)
   Affected: 7.4.33 (built before 21 October 2026) Patched: 7.4.33 (built on 21 October 2026)
   

   PHP on Plesk Obsidian for Windows

   PHP 8.5
   Affected: 8.5.11 and below Patched: 8.5.12
   PHP 8.4
   Affected: 8.4.26 and below Patched: 8.4.27
   PHP 8.3
   Affected: 8.3.35 and below Patched: 8.3.36
   PHP 8.2
   Affected: 8.2.34 and below Patched: 8.2.35
   

   Plesk Obsidian – Internal PHP Engine

   Plesk for Linux (sw-engine component)
   Affected versions:
   - Plesk Obsidian 18.0.80 Update 10 and below - Plesk Obsidian 18.0.81 through Update 3
   Patched versions:
   - Plesk Obsidian 18.0.80 Update 11 (18.0.80.11) - Plesk Obsidian 18.0.81 Update 4 (18.0.81.4)
   Plesk for Windows (plesk-engine component)
   Affected versions:
   - Plesk Obsidian 18.0.80 Update 10 and below - Plesk Obsidian 18.0.81 through Update 3
   Patched versions:
   - Plesk Obsidian 18.0.80 Update 11 (18.0.80.11) - Plesk Obsidian 18.0.81 Update 4 (18.0.81.4)
   

   Action Required

   Customers operating Plesk servers are strongly encouraged to review their installed Plesk and PHP versions and apply the relevant security updates as soon as possible.
   To update your Plesk installation:
   1. Log into your Plesk control panel.
   2. Navigate to Tools & Settings > Updates and Upgrades.
   3. Install the latest applicable Plesk updates, including version 18.0.80.11 or 18.0.81.4, depending on your installed release.
   4. Verify your installed Plesk version under Tools & Settings > Server Components.
   5. Review your installed PHP versions under Tools & Settings > PHP Settings.
   6. Ensure all applicable PHP versions have been updated to the patched releases listed above.
   Important: For end-of-life PHP versions such as 7.4, 8.0 and 8.1, the PHP version number may remain unchanged after patching. The build date and installed package information should be checked to confirm the applicable security updates have been applied.
   

   Further Information

   For further details about these vulnerabilities and the available security updates, please refer to the official Plesk documentation:
   Plesk Security Advisory – CVE-2026-109618 and CVE-2026-109619
   For guidance on viewing and managing PHP versions within Plesk, please refer to:
   Plesk Documentation – Configuring PHP Handlers
   We understand that applying security updates may require additional planning, particularly for environments running older PHP versions or applications.

   We appreciate your patience and cooperation as we work together to ensure the ongoing security of your services.

   For further updates, please continue to monitor Servers Australia's Status Page.

Reported by Servers Australia on their status page.

1. resolvedOct 21 · 18:58 UTC

   The MySAU Customer Portal is back online and fully operational. The required PHP security updates have been applied, and customer access has been restored. We thank our customers for their patience and understanding while we took the necessary precautions to protect our systems and customer information.

Reported by Servers Australia on their status page.

1. resolvedOct 12 · 08:07 UTC

   Following the implementation of remediation measures, we have continued monitoring the service and confirmed that DNS resolution is operating normally. Email delivery and other services that rely on DNS resolution have returned to normal operation, with no further issues observed. We appreciate your patience and understanding while our team worked to restore normal service.

Reported by Servers Australia on their status page.

1. resolvedSep 28 · 06:38 UTC

   Engineers have resolved the problem and the MySAU Portal & accompanying services are now back online.

Reported by Servers Australia on their status page.