Plesk shipped Obsidian 18.0.79 to the official changelog on 23 June 2026, with the public blog announcement following on 3 July. It's a heavier release than the version number suggests — the REST API finally gets multi-tenant access, SQL Server 2025 lands as an installable option, and a "comprehensive security audit" (Plesk's own phrase) drove a hardening pass across the panel. If you manage more than a handful of Plesk servers, this one is worth scheduling deliberately rather than letting it queue behind other maintenance.
The headline change: REST API access for resellers and customers
Until 18.0.79, the Plesk REST API was admin-only. Every automation tool built for resellers or end customers had to either impersonate an admin token or fall back to the older XML API. That's gone: reseller and customer accounts can now hold their own API credentials, scoped to their own accounts, with new endpoints for file management, log searching, and user impersonation.
For hosts reselling Plesk, this is the change that actually matters — it means you can finally build customer-facing automation (a client portal button that greps a log, a self-service file browser, a "reset my PHP handler" action) without minting admin-level tokens per customer. If you're already using the API for provisioning, see managing reseller and customer accounts via the Plesk REST API for the endpoint patterns this release extends.
Microsoft SQL Server 2025 support
Plesk Installer can now pull down and configure SQL Server 2025 locally on Windows hosts. Previous Plesk builds topped out at SQL Server 2022 for local installs (2025 was reachable only via remote/external connections). If you run a Windows fleet with clients on legacy ASP.NET or classic ASP stacks that pin to a specific SQL Server version, check compatibility before switching — 2025 drops some deprecated T-SQL syntax that 2022 still tolerated.
AlmaLinux 8 → 9 in-place migration script
Plesk published a new upgrade script on GitHub for migrating AlmaLinux 8 hosts to AlmaLinux 9 in place, alongside the existing fresh-install path covered in installing Plesk on AlmaLinux 9. AlmaLinux 8 goes EOL in May 2029, so there's no urgency yet — but if you're already planning a broader OS consolidation this cycle, it's now a supported route instead of a "back up everything and pray" reinstall.
Security hardening from the audit
Plesk doesn't publish a CVE-by-CVE breakdown for this release the way cPanel does for its Technical Security Releases, but the changelog is explicit that security was the priority:
- Stricter SSL/TLS certificate verification in the Linux license management component — tightens how the panel validates certs when talking to Plesk's licensing servers.
- Automatic DKIM signing for locally generated mail on Plesk for Linux, plus improved DMARC authentication reliability — fewer outbound messages landing in spam because a signing key was never rotated in. Pairs well with a SPF/DKIM/DMARC audit if you haven't done one recently, even though that guide is written for cPanel — the underlying DNS record requirements are the same.
- Component bumps with security relevance: ModSecurity CRS to 4.27.0, ModSecurity itself to 2.9.13 on Linux, nginx to 1.30.3, Dovecot/Pigeonhole to 2.4.4, and Grafana to 12.4.3.
If you're running ModSecurity rule sets on Plesk, re-check your whitelist after the CRS bump — rule ID renumbering between major CRS versions occasionally reintroduces false positives on custom whitelist entries.
UI and workflow changes
- Default theme switches from Light to Contrast for higher visibility — cosmetic, but it will generate support tickets from customers who open a ticket assuming something broke.
- Secret Keys Manager now shows key ownership and lets admins create keys on behalf of customers and resellers — useful for support-assisted key rotation.
- AI Support Assistant ships in opt-in beta. Leave it off on servers with strict data residency requirements until Plesk publishes where the queries are processed.
Deprecations to plan around
Upgrade recommendation
Plesk's own release notes call this "strongly recommended" given the security scope, and that's the right read — none of the changes are individually dramatic, but the combination of a licensing-related TLS fix, mail-authentication reliability, and a batch of third-party component CVEs closed in one release makes this a should-not-defer update. Schedule it in a maintenance window that also covers a stats-page and PageSpeed audit, since those are the two things most likely to generate customer tickets afterward. Keep your Plesk license current so the update channel and license validation don't add friction on top of the maintenance window itself.