{
    "schema": 1,
    "publisher": "Vanta Panel",
    "updated": "2026-10-22",
    "url": "https://vantapanel.com/security/advisories",
    "advisories": [
        {
            "id": "VP-2026-007",
            "title": "Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619",
            "published": "2026-10-22",
            "severity": "critical",
            "component": "PHP (operating system packages)",
            "fixed": "5.54",
            "summary": "Two critical vulnerabilities in PHP itself, published by the PHP project on 21 October 2026, let an attacker with no account run code on a server through PHP. Vanta Panel 5.54 installs the fixed PHP packages and restarts every PHP process, the panels included, because running processes keep using the old code until they restart.",
            "impact": "Any server running a PHP 8.2, 8.3, 8.4 or 8.5 build without the fix, or a PHP 8.1 build without its distribution's fix. The PHP project rates both 9.2 (critical); no sign-in is needed. Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; in Ubuntu 24.04 by 8.3.6-0ubuntu0.24.04.13 and Ubuntu 22.04 by 8.1.2-1ubuntu2.28; in Debian 12 by 8.2.35-1~deb12u1 and Debian 13 by 8.4.27-1~deb13u1.",
            "action": "Update to Vanta Panel 5.54 or later, then check vWHM, PHP Security: every PHP version should show as patched. If you cannot update the panel yet, install your distribution's PHP security updates and restart PHP-FPM, Apache and both panels.",
            "auto_repair": "Yes. Servers with automatic updates on install 5.54 within a day; 5.54 installs the PHP fixes and restarts PHP right away, and from then on installs PHP security updates every day while automatic PHP patching is on (the default).",
            "cve": [
                "CVE-2026-109618",
                "CVE-2026-109619"
            ],
            "references": [
                {
                    "title": "PHP: 21 October 2026 security releases (php.net)",
                    "url": "https://www.php.net/archive/2026.php#2026-10-21-5"
                },
                {
                    "title": "GHSA-w8hw-w9fx-j79w: CVE-2026-109618 (PHP)",
                    "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
                },
                {
                    "title": "GHSA-6wmf-4rv5-p3rp: CVE-2026-109619 (PHP)",
                    "url": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"
                },
                {
                    "title": "Ubuntu USN-8948-1",
                    "url": "https://ubuntu.com/security/notices/USN-8948-1"
                },
                {
                    "title": "Debian DSA-6574-1 (Debian 13)",
                    "url": "https://security-tracker.debian.org/tracker/DSA-6574-1"
                },
                {
                    "title": "Debian DLA-4848-1 (Debian 12)",
                    "url": "https://security-tracker.debian.org/tracker/DLA-4848-1"
                },
                {
                    "title": "How to patch the October 2026 PHP vulnerabilities",
                    "url": "https://vantapanel.com/blog/php-security-update-october-2026"
                }
            ],
            "url": "https://vantapanel.com/security/advisories/vp-2026-007"
        },
        {
            "id": "VP-2026-006",
            "title": "Some removed database hosts and subdomains stayed active",
            "published": "2026-10-22",
            "severity": "medium",
            "component": "vPanel removals",
            "fixed": "5.52",
            "summary": "A remote database host removed from an account kept its database access, and a deleted subdomain kept serving its HTTPS site. Vanta Panel 5.52 removes both completely.",
            "impact": "Accounts where a remote database host or a subdomain was removed before 5.52.",
            "action": "Update to Vanta Panel 5.52 or later. Removals made on an older version are not cleaned up by the update: check that remote database hosts removed earlier no longer have a MySQL user, and that deleted subdomains no longer answer over HTTPS.",
            "auto_repair": "No. The fix applies to removals made after the update.",
            "credit": "Found in Vanta Panel's own testing.",
            "references": [
                {
                    "title": "Vanta Panel 5.52 release notes",
                    "url": "https://vantapanel.com/releases#v5-52"
                }
            ],
            "url": "https://vantapanel.com/security/advisories/vp-2026-006"
        },
        {
            "id": "VP-2026-005",
            "title": "Backup restores and cPanel imports could reach other accounts' data",
            "published": "2026-10-22",
            "severity": "high",
            "component": "Backup restore and cPanel import",
            "fixed": "5.50",
            "summary": "Restoring a backup, or importing a cPanel backup in vWHM, could affect databases and database users outside the account being restored. Vanta Panel 5.50 limits restores and imports to the account's own databases and database users.",
            "impact": "Servers where customers restore their own backups, and servers that imported cPanel backups from sources that are not fully trusted. A hosting customer could reach other customers' databases this way.",
            "action": "Update to Vanta Panel 5.50 or later. If cPanel backups from sources you do not fully trust were imported before 5.50, review the server's database users and their access.",
            "auto_repair": "The fix applies to every restore and import after the update. Changes made by an earlier restore or import are not undone automatically.",
            "credit": "Found in Vanta Panel's own security review.",
            "references": [
                {
                    "title": "Vanta Panel 5.50 release notes",
                    "url": "https://vantapanel.com/releases#v5-50"
                }
            ],
            "url": "https://vantapanel.com/security/advisories/vp-2026-005"
        },
        {
            "id": "VP-2026-004",
            "title": "Database permissions could reach another account's databases",
            "published": "2026-10-22",
            "severity": "high",
            "component": "Databases (MySQL/MariaDB permissions)",
            "fixed": "5.50",
            "summary": "In some cases, database access the panel gave one hosting account also applied to databases of another account on the same server. Vanta Panel 5.50 corrects how database permissions are granted and repairs existing ones automatically.",
            "impact": "Servers with more than one hosting account. A customer could, in some cases, read, change or delete another customer's databases.",
            "action": "Update to Vanta Panel 5.50 or later. If you gave a database user access by hand, outside the panel, check that access after the update.",
            "auto_repair": "Yes. Right after the update the panel repairs existing database permissions once; if that cannot finish, it retries every hour.",
            "credit": "Found in Vanta Panel's own security review.",
            "references": [
                {
                    "title": "Vanta Panel 5.50 release notes",
                    "url": "https://vantapanel.com/releases#v5-50"
                }
            ],
            "url": "https://vantapanel.com/security/advisories/vp-2026-004"
        },
        {
            "id": "VP-2026-003",
            "title": "The panel's unprivileged service account could gain root access",
            "published": "2026-10-22",
            "severity": "high",
            "component": "Installed panel files and updater",
            "fixed": "5.49",
            "summary": "On versions up to 5.48, someone who already controlled the panel's own unprivileged service account could gain full control of the server. Vanta Panel 5.49 removes the cause and repairs existing installations on its first run.",
            "impact": "Every server on 5.48 or earlier. It needs prior control of the panel's service account, so it matters most in combination with another weakness.",
            "action": "Update to Vanta Panel 5.49 or later. Nothing else is needed: the update repairs the installation once, and every later update checks it again.",
            "auto_repair": "Yes. 5.49 repairs existing installations automatically on its first run.",
            "credit": "Found in Vanta Panel's own security review.",
            "references": [
                {
                    "title": "Vanta Panel 5.49 release notes",
                    "url": "https://vantapanel.com/releases#v5-49"
                }
            ],
            "url": "https://vantapanel.com/security/advisories/vp-2026-003"
        },
        {
            "id": "VP-2026-002",
            "title": "Cross-site request protection did not apply in some panel sessions",
            "published": "2026-10-22",
            "severity": "medium",
            "component": "vPanel and vWHM sessions",
            "fixed": "5.41",
            "summary": "The panels' protection against cross-site request forgery did not apply in some sessions. In those sessions a web page opened by a panel user could have sent requests to the panel on that user's behalf. Vanta Panel 5.41 applies the protection in every session.",
            "impact": "vPanel and vWHM users on versions before 5.41 who opened a malicious web page in the same browser.",
            "action": "Update to Vanta Panel 5.41 or later. Nothing else is needed.",
            "auto_repair": "Yes. The fix takes effect as soon as the update is installed.",
            "credit": "Found in Vanta Panel's own security review.",
            "references": [
                {
                    "title": "Vanta Panel 5.41 release notes",
                    "url": "https://vantapanel.com/releases#v5-41"
                }
            ],
            "url": "https://vantapanel.com/security/advisories/vp-2026-002"
        },
        {
            "id": "VP-2026-001",
            "title": "PHP isolation did not cover every website of an isolated account",
            "published": "2026-10-22",
            "severity": "medium",
            "component": "Account isolation (PHP-FPM)",
            "fixed": "5.41",
            "summary": "On accounts set to run PHP in their own isolated pool, isolation did not apply to every website of the account, so the separation between accounts was weaker than the setting showed. Vanta Panel 5.41 applies it to every website of an isolated account.",
            "impact": "Servers where accounts were switched to isolated PHP before 5.41. Code running on one of those websites, such as a compromised site, was not always limited to the account's own Linux user.",
            "action": "Update to Vanta Panel 5.41 or later. Accounts isolated before 5.41 keep their previous setup and are listed as partially isolated under vWHM, MultiPHP / Isolation: click Complete isolation there, then check those accounts' sites.",
            "auto_repair": "Partly. New and newly isolated accounts are fully isolated. Accounts isolated before 5.41 are left exactly as they were, so no site changes behaviour unexpectedly, until you click Complete isolation.",
            "credit": "Found in Vanta Panel's own security review.",
            "references": [
                {
                    "title": "Vanta Panel 5.41 release notes",
                    "url": "https://vantapanel.com/releases#v5-41"
                }
            ],
            "url": "https://vantapanel.com/security/advisories/vp-2026-001"
        }
    ]
}