Plesk: automatic updates and security patches

Updated November 2026

Plesk Obsidian installs its own updates once a day by default, but security fixes go only to the latest two 18.0 updates, extensions update on their own weekly schedule, and operating system packages are not updated by Plesk unless you turn that on. Check all three, and keep the admin port 8443 closed to everyone but your admin addresses.

What Plesk is

Plesk is a commercial hosting control panel for Linux and Windows servers. Administrators, resellers and customers all log in to the same interface, by default on port 8443 (HTTPS) or 8880 (HTTP). Plesk ships its own builds of PHP, web and mail components, and adds features through extensions. Several serious 2026 vulnerabilities were in extensions rather than in Plesk itself, so extensions need the same attention as the panel.

Check your version

plesk version                  # product version, OS, build date, revision
cat /usr/local/psa/version     # the same in one line (Linux)

Plesk numbers updates as 18.0.NN and micro-updates as “Update N”, which advisories often write as 18.0.NN.N (for example 18.0.80.4 is 18.0.80 Update 4).

Supported versions and lifecycle

Since Obsidian, version 18 is the only major version and has no end-of-life date. Instead, Plesk provides patches and support for the latest available update and the preceding one. As of November 2026 that means:

Both November 3 micro-updates fix what Plesk calls “a critical security issue” on Linux and regenerate the web server configuration of all domains, so review any custom virtual host templates afterwards.

The operating system matters too. Plesk for Linux supports Ubuntu 22.04, 24.04 and 26.04, Debian 12 and 13, AlmaLinux 8, 9 and 10, Rocky Linux 8, RHEL 8 and 9, and CloudLinux 8 and 9. Plesk 18.0.81 is the last release for Debian 11, whose vendor support ended on August 31, 2026, so Debian 11 servers are stuck on an update that loses support once a newer one follows 18.0.82. CentOS 7, CloudLinux 7, Debian 10, Ubuntu 18.04 and Ubuntu 20.04 are covered only by paid Extended Lifecycle Support until January 1, 2028. See Is my OS supported?.

Automatic update settings

Under Tools & Settings » Update Settings, check both boxes:

• Automatically install Plesk updates: on by default. Plesk checks once a day and installs updates through Plesk Installer.
• Automatically install updates for third-party components shipped by Plesk (Linux): on by default; covers components such as PHP and the web server that Plesk ships.

To limit when updates start, add a window to /usr/local/psa/admin/conf/panel.ini. Times are UTC, and at least two days or hours must be given:

[updates]
updateDays = saturday,sunday
timeFrameStart = 11
timeFrameEnd = 18

A narrow window delays urgent fixes, so keep it wide. Extensions are separate: by default Plesk checks them once a week and installs updates automatically. Check that the “Auto-update” slider under Extensions » Updates is on, and use “Check Now” after an extension advisory.

Update now from the command line

# install all available updates, including components such as MariaDB and PHP
sudo plesk installer --select-release-latest --upgrade-installed-components

# install only Plesk's own updates (components only if Plesk needs them)
sudo plesk installer install-panel-updates

# confirm
plesk version

Updates may restart the web server, mail and Plesk services, and a micro-update like 18.0.82 Update 2 rewrites every domain’s web server configuration. Run updates outside peak hours if you can, but do not wait days for a critical fix. Plesk Installer uses TCP port 8447; to send it through the normal Plesk port instead, run sudo plesk bin settings --set installerProxyMode=true.

Operating system updates under Plesk

Plesk does not update the kernel, OpenSSL, glibc or other system packages unless you enable it. In Tools & Settings » System Updates, the option “Automatically install system package updates” is off by default. You can turn it on there, use the distribution’s own tools (see Automatic updates), or update by hand:

sudo apt update && sudo apt upgrade        # Debian, Ubuntu
sudo dnf upgrade --refresh                 # AlmaLinux, Rocky, RHEL, CloudLinux

The System Updates screen can lock packages you do not want upgraded. A new kernel needs a reboot, which restarts every hosted site; see Restarts and reboots for checking what still needs a restart.

Recent security issues

See the vulnerability list for other software on the same server.

Restrict panel ports to admin IPs

Customers often need to log in to Plesk, so you cannot always close 8443 entirely. You can still limit who reaches the administrator account:

• Tools & Settings » IP Access Restriction Management (under Security) can allow administrator logins only from listed IPs or subnets. It does not stop resellers or customers from logging in, and it does not cover SSH. Add your own address first; if you are locked out, the fix is to add your IP to the allowed list from the command line or the console.
• If only admins use the panel, restrict TCP 8443, 8880 and 8447 in the firewall to admin addresses or a VPN. Use either the Plesk Firewall extension or firewalld, never both, because they can overwrite each other’s rules and close ports Plesk needs.
• Close 8880 (plain HTTP) if nobody needs it.

The firewall guide shows the general method.

Turn on multi-factor authentication

Plesk’s MFA extension is installed by default. Each user opens My Profile, selects “Enable Multi-factor Authentication”, scans the QR code with any TOTP app (Plesk mentions Google Authenticator and Microsoft Authenticator) and enters the code. Use “Remember Device” only on your own computer. To make MFA mandatory for every account, including the administrator, set it up on your own account first and then add to /usr/local/psa/admin/conf/panel.ini:

[ext-mfa]
enforce = true
allowSkipEnforce = false

Plesk cannot enforce MFA for some account types only; it is all or nothing.

Where advisories are published

• The Plesk Obsidian change log, with an RSS feed that also covers extensions. Security fixes are marked in each entry.
• Individual vulnerability articles on support.plesk.com, for example CVE-2026-44962.
• National CERTs such as the Canadian Centre for Cyber Security. See Security advisories.

Quick hardening tips

• Leave automatic Plesk updates and extension auto-update on; check after each advisory that the version changed.
• Decide who updates OS packages (Plesk System Updates or the distribution’s tools) and make sure one of them is on.
• Stay on one of the two latest 18.0 updates; older ones get no fixes.
• Restrict administrator logins by IP, and the ports themselves if customers do not log in.
• Enforce MFA for all accounts.
• Remove extensions you do not use; each one is extra code running as root.
• Move off Debian 11 and other end-of-life systems before the panel stops supporting them.

Sources

• Plesk Lifecycle Policy, Plesk
• Plesk Obsidian change log, Plesk documentation
• Plesk Obsidian software requirements, Plesk documentation
• Plesk updates and upgrades, Plesk Obsidian administrator guide
• Extensions Catalog, Plesk Obsidian administrator guide
• Upgrading Plesk for Linux in unattended mode, Plesk deployment guide
• Plesk for Linux and firewalld compatibility, Plesk deployment guide
• Setting up multi-factor authentication in Plesk, Plesk documentation
• WebPros security advisory AV26-961, Canadian Centre for Cyber Security
• Plesk security advisory AV26-534, Canadian Centre for Cyber Security