Plesk released Obsidian 18.0.82 on 27 October 2026, followed a day later by 18.0.82 Update 1 (and 18.0.81 Update 6 for servers still on the previous release). It is a bigger release than usual: a security fix for multi-factor authentication, two removals that break things if you ignore them, and new Python and Node.js tooling worth offering to customers.
This note covers what changed for hosts running Plesk fleets. The XML-RPC removal has its own write-up in Plesk 18.0.82 drops XML-RPC protocols older than 1.6.9.1.
Security fixes
- Admin MFA bypass (EXTPLESK-14503). MFA was silently skipped for the administrator account after its GUID was regenerated. The Multi-Factor Authentication extension 1.3.4 also fixes MFA being switched off after a license key update, tracked under the same ID. If you rely on MFA for the admin login, treat this as the reason to upgrade.
- Brotli 1.2.1 (Update 1). On Linux, the Brotli library used by nginx moves to 1.2.1. On Windows, the plesk-engine PHP build is rebuilt against it to address CVE-2026-111497, the Brotli decoder out-of-bounds write that also drove the October Node.js security release.
- Component bumps. ModSecurity 2.9.15, ModSecurity 3.0.17, and OWASP CRS 4.30.0 on Linux. Re-test any custom ModSecurity whitelist rules after the CRS update.
Removals that break things
If a legacy integration fails and you need time, panel.ini has a temporary escape hatch. Plesk calls it insecure, so use it for days, not months:
[api]
oldVersionsSupported = true
Deprecations to plan for 18.0.84
Two features go away in 18.0.84, which Plesk schedules for January 2027:
- Social Login. Logins through Google, Facebook, GitHub, or passkeys stop working. Customers who never set a Plesk password need one before then. Admins can issue a one-time link with
plesk login, and the MFA extension replaces passkeys as the second factor. - Plesk Mobile Center. The extension is removed and the mobile apps lose server management. After upgrading, delete the API keys Plesk Mobile created with
plesk bin secret_key.
New for customers
Python extension
A new extension on Plesk for Linux lets customers enable Python per domain, manage virtual environments, read pyproject.toml metadata, set environment variables and encrypted secrets, and run WSGI apps through Phusion Passenger. It needs Plesk 18.0.79 or later and the Python support management permission in the service plan. It can also detect Python apps already on the server.
Node.js Toolkit CLI
The Node.js Toolkit gets a redesigned UI, per-application logs, Git URLs as a content source, and a full CLI under plesk ext nodejs. Start with the app inventory:
plesk ext nodejs --list
The new commands cover dependencies and scripts (--install-dependencies, --run-script), environment variables (--env, --set-env, --unset-env), Git deployment (--clone-from-git, --deploy, --redeploy), and process control (--status, --start, --stop, --restart). --auto-configure is also exposed through the XML API, and -dry-run and -json options make it scriptable.
AI Support Assistant and MCP
When a server is connected to the WebPros dashboard MCP server, the AI Support Assistant can now call Plesk utilities, with the administrator approving each call or batch. It can also be opened to resellers and customers through chat.enabled and chat.enabledTypes in the [copilot] section of panel.ini. Leave it admin-only until you have decided what your customers' data handling terms say about it.
Other changes worth knowing
- Backup create, restore, import, and removal events now appear in the Action Log.
- SSL It! can issue certificates over DNS-01 for domains without web hosting, including wildcards.
- Public OS upgrade scripts for AlmaLinux 9 to 10, CloudLinux 8 to 9, and Ubuntu 24 to 26.
- REST API: a new Ability to use REST API plan permission, and customers can create their own keys via
POST /api/v2/auth/keys.
Upgrade
Check the current version, then upgrade:
plesk version
plesk installer --select-product-id plesk --select-release-latest --upgrade-installed-components
If the installer stops on dependency conflicts, follow fixing Plesk update failures. Keep your Plesk license active so the update channel stays available.