Learn What's New in Plesk Obsidian 18.0.82 and What to Check Before You Upgrade

Oct 30, 2026HostingPlesk
← Back to Blog
Summarize with AI: Google AI Claude ChatGPT Perplexity Grok

AI links open with a title + excerpt (these tools can't fetch the page themselves) — use "Copy full article" to paste the complete text for a fuller summary.

Share:

Introduction

This article demonstrates what is new in Plesk Obsidian 18.0.82, and what you should check before you upgrade.

Plesk released 18.0.82 on 27 October 2026. Update 1 followed on 28 October. I read the full change log and compared it with 18.0.81 from September, so you only see what actually changed.

Plesk Obsidian 18.0.82

Plesk Obsidian is the control panel many hosting companies use for websites, mail, DNS and databases. Version 18.0.82 has three themes. AI moves into the daily work of every user. Python and Node.js hosting become real developer tools. And some old parts are finally removed.

Features

  • AI Support Assistant for resellers and customers, not only administrators.
  • A new Python extension for hosting Python applications (Linux).
  • A redesigned Node.js Toolkit with per-application logs.
  • SSL It! certificates over DNS-01 for domains with no web hosting.
  • More than ten SSL renewal fixes and more than ten REST API fixes.
  • Removal of Debian 11 and of old XML RPC protocol versions.

With the following steps, you can understand the release and plan your upgrade.

  1. AI Support Assistant for Every Role
  2. Python and Node.js Hosting
  3. SSL and Security Improvements
  4. Smaller Improvements
  5. Removed and Deprecated Items
  6. Upgrade Scripts and Component Updates

AI Support Assistant for Every Role

In 18.0.81 the assistant got multiple conversations, and you could connect an MCP client through your WebPros Account. In 18.0.82 it goes further.

  • Resellers and customers can use it. The assistant knows the user's role and only gives answers that user can act on.
  • It can run Plesk utilities. On servers connected to the WebPros dashboard MCP server, the assistant can call Plesk tools. The administrator approves each call, or each batch of calls.
  • Impersonation warning. When an administrator talks to the assistant while logged in as a customer, a clear warning says the customer can see those chats.
  • Nova AI App Builder. Hosting partners can now offer Nova to customers. Add the "Nova on Plesk" license key, then add a Nova plan to your service plans.

You control which roles see the chat in panel.ini:

[copilot]
chat.enabled = true
chat.enabledTypes = admin, reseller, client, adminAlias

Remove a role from chat.enabledTypes to hide the assistant from it.

My best suggestion is to enable it for administrators first. Watch the answers for a week, then open it to customers.

Python and Node.js Hosting

This is the most useful part of the release for developers.

New Python extension (Linux). It needs Plesk Obsidian 18.0.79 or later. A new "Python support management" permission in service plans controls who can use it.

  • Enable Python for a domain in a few clicks.
  • Create a virtual environment and install dependencies from the interface.
  • View project metadata read from pyproject.toml.
  • Add environment variables and encrypted secrets.
  • Restart the application in one click, or install a demo app.
  • Scan for existing Python applications.

Applications run as WSGI applications through Phusion Passenger. Plesk writes the web server configuration for you.

Redesigned Node.js Toolkit (Linux). 18.0.81 added pnpm support and the first version of auto-configuration. 18.0.82 makes it a full toolkit.

  • Status and Application Type on the Dashboard tab, with start, stop and restart controls.
  • Per-application logs. Plesk calls this one of the most requested Node.js features.
  • A Git repository URL can be the source of an application.
  • Bulk editing of environment variables, with secrets support.

There are many new CLI commands. Most of them also work through the XML API.

plesk ext nodejs --auto-configure -domain example.com -dry-run
plesk ext nodejs --redeploy -domain example.com
plesk ext nodejs --list

Important: --clone-from-git needs Git extension 2.0.4 or later. --status, --start, --stop and --restart are CLI only.

SSL and Security Improvements

  • DNS-01 for domains with no web hosting. SSL It! can now issue certificates for these domains, including wildcard certificates, from the UI and the CLI. They renew automatically as wildcards.
  • Sectigo and DigiCert. Installing SSL It! now installs both extensions too.
  • EAB accounts survive migration. Before this, certificates from CAs that need External Account Binding, such as JPRS, stopped renewing after a migration.
  • Backups in the Action Log. Backup, restore, import and removal events are now recorded, including rotation.

The fixes matter more than the features here. Two stand out. During auto-renewal, one domain's Let's Encrypt certificate could be overwritten with an unrelated domain's certificate (EXTPLESK-14488). And MFA could be silently skipped for the administrator after the account GUID was regenerated (EXTPLESK-14503). Several other fixes stop "Keep websites secured" from piling up pending ACME orders every hour.

Update 1 updates Brotli to 1.2.1 for CVE-2026-111497.

Smaller Improvements

  • Password reset email templates are now editable.
  • The Panel.ini Editor lets you edit values directly on the "Viewer" tab.
  • Performance Booster supports MariaDB 12.3.
  • On Windows, you can change the Web Deploy publishing URL at server and domain level.
  • You can hide the "Log in with WebPros Account" button with [webProsAccount] loginButton = 0.
  • REST API: a new "Ability to use REST API" permission in service plans, and customers can issue their own API keys through POST /api/v2/auth/keys.

Removed and Deprecated Items

Read this section before you upgrade. These are the changes that can break something.

  • Debian 11 is gone. 18.0.81 was the last release for it. New releases are no longer published for Debian 11. Upgrade to Debian 12 or migrate.
  • XML RPC older than 1.6.9.1 now returns errors. Old billing systems or automation scripts may stop working. A temporary panel.ini override exists ([api] oldVersionsSupported = true), but Plesk calls it insecure.
  • Social Login will be removed in 18.0.84 (January 2027). Sign-in with Google, Facebook, GitHub or passkey will stop. Plesk passwords and WebPros Account logins are not affected.
  • Plesk Mobile apps are deprecated. In 18.0.84 the Mobile Center extension is removed and the apps lose server management.
  • Horde Webmail gets no more fixes. It was deprecated in 18.0.64. Administrators now see a warning where it is still installed.

Warning: Check your XML RPC integrations first. It is the change most likely to fail quietly in production.

Upgrade Scripts and Component Updates

Plesk published new in-place upgrade scripts on GitHub:

  • AlmaLinux 9 to 10 (plesk/almalinux9to10)
  • CloudLinux 8 to 9 (plesk/cloudlinux8to9)
  • Ubuntu 24 to 26 (plesk/ubuntu24to26)

Main component updates: ModSecurity 2.9.15 and 3.0.17, OWASP CRS 4.30.0, and Postfix 3.5.28 on older systems. On Windows: OpenSSL 3.5.9, Python 3.14.9, Node.js 24.22.1 and 22.23.4, ASP.NET Core Runtime 10.0.13, and new PHP 8.2 to 8.5 builds.

I prefer to say it clearly: an upgrade script is not a backup. Take a full server backup or snapshot before you run any of them.

Conclusion

In this article we learned what changed in Plesk Obsidian 18.0.82. The AI assistant now reaches every role. Python hosting is new, and Node.js hosting is much stronger. SSL renewal is more reliable. Before you upgrade, check Debian 11 servers, old XML RPC clients, and users who sign in with Social Login.

Reference

#plesk#plesk-obsidian#release-notes#python#nodejs#ssl#web-hosting

Comments

Be the first to comment.

Leave a comment

Never shown publicly.

Comments are reviewed before appearing publicly.