Plesk serves each subscription with a selected PHP handler. Updating the OS php package misses a domain whose handler is a Plesk PHP build.
What to look at
Plesk’s PHP settings screen shows the handler: FPM, FastCGI, or CGI, and the version. The binary lives under Plesk’s PHP prefix. Note the handler, because a switch from FPM to CGI during an update would be a behavior change you did not plan.
Remediation
Install the Plesk PHP update that names both CVEs, or remove the public handler until it exists. Restart the per-domain FPM service Plesk uses. Confirm with the domain’s PHP info page after the restart, not only with the Plesk package list.
Nginx or Apache in front of Plesk is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating Plesk fix PHP2Shell?
No. Plesk runs on PHP. The PHP binary or package that serves it has to be patched or replaced.