Update - May 18, 2026

Plesk has released Plesk Obsidian 18.0.78 Update 1, which includes security improvements and updates nginx and the sw-cp-server service to version 1.30.1 on Linux systems. Reliable Penguin is in the process of installing this update across all managed client servers. 

No customer action is required at this time. We will continue monitoring the rollout and will take any additional remediation steps as needed.

Reference: https://docs.plesk.com/release-notes/obsidian/change-log/

May 15, 2026

Reliable Penguin is aware of CVE-2026-42945, a vulnerability affecting certain nginx versions prior to 1.31.1 and 1.30.1. The issue may allow denial of service in affected configurations, and remote code execution may be possible in limited circumstances.

This vulnerability may affect some Plesk-managed Linux systems depending on the installed nginx version and rewrite-rule configuration.

Reliable Penguin is actively reviewing managed systems for exposure to this issue. Our response includes checking nginx versions, reviewing potentially affected rewrite rules, confirming relevant system protections where applicable, and applying vendor-recommended mitigations or updates.

Reliable Penguin now follows an update-and-notify security maintenance model for managed systems. Under this policy, automatic security updates are enabled by default, and critical or high-priority security updates may be applied as soon as practical rather than waiting for a scheduled maintenance window. Clients are notified after updates that require or result in a system reboot, while routine service restarts generally do not trigger separate notifications.

For this nginx vulnerability, Reliable Penguin may apply mitigations or vendor patches without prior client approval when delaying action would create unnecessary security risk. No system reboots are required for the currently recommended mitigations or expected update. A brief nginx service restart or reload may occur as part of mitigation or patching, but this is considered routine security maintenance and will not typically trigger a separate notification.

Customers do not need to take action unless they manage their own nginx, Plesk, or server configuration outside of Reliable Penguin’s managed services. Customers with self-managed systems should review vendor guidance, confirm whether affected nginx versions and rewrite rules are present, and apply the recommended update or mitigation.

We will continue monitoring vendor guidance and will update this notice as new information becomes available.

Reference: Plesk advisory for CVE-2026-42945