The current release is Vanta Panel 5.55, released . Every release below is Ed25519-signed and installs itself on servers with automatic updates on (the default). Security releases are marked and link to their advisory.
vWHM now shows Vanta Panel security advisories: Updates lists every published advisory that affects the version you run, and the dashboard warns about critical and high ones.
Advisories are downloaded from get.vantapanel.com and checked against the release signing key before they are shown; alert emails include them when update alerts are on.
Every advisory and the full release history are public at vantapanel.com/security/advisories and vantapanel.com/releases, with Atom feeds.
Security: Vanta Panel now keeps PHP patched. This update installs the fixes for the critical PHP vulnerabilities announced on 21 October 2026 (CVE-2026-109618, CVE-2026-109619) and restarts every PHP service, the panels included, so the fix takes effect.
New in vWHM: PHP Security shows whether each PHP version is patched, installs PHP updates with one click, and restarts anything still running old PHP code.
Automatic PHP patching, on by default: PHP updates are installed daily, and PHP services are restarted after any PHP update, including Ubuntu's and Debian's own automatic security updates. You get an email when it happens.
Extra hardening recommended by PHP: session upload progress is switched off. It can be switched back on under PHP Security.
Seven features cPanel and WHM had and Vanta Panel did not: PHP Settings, a root Terminal and Reseller accounts in vWHM; a ModSecurity web application firewall, a Virus Scanner, Web Disk and Calendars & Contacts for every account.
vWHM → PHP Settings: server-wide php.ini defaults per PHP version (memory, upload sizes, timezone, error reporting and more) with a raw editor for the rest; every change is checked before it goes live, and per-account settings still take precedence.
vWHM → Terminal: a root shell in the browser for server administrators with two-factor authentication on; every command is recorded in the Audit Log.
vWHM → Resellers: give a partner their own vWHM sign-in that manages only the accounts they own, within the account, mailbox and database allowances you set.
vWHM → ModSecurity: install the OWASP Core Rule Set with one click (blocking, detection-only or off, with a log of blocked requests); customers can switch it off per domain in vPanel.
Virus Scanner: install ClamAV from vWHM, then every account can scan its mail, website files or whole home from vPanel and quarantine, delete or restore what it finds.
Web Disk: open a folder of your account as a network drive on Windows, macOS or Linux (WebDAV over HTTPS on port 2078, like cPanel), with extra read-only or read-write logins for colleagues and clients; administrators can switch it off server-wide in vWHM → Settings.
Calendars & Contacts: once enabled in vWHM → Settings, every mailbox gets a calendar and an address book that phones, Thunderbird, macOS and Outlook can sync (CalDAV/CardDAV), with the URLs and setup steps under vPanel → Email → Calendars & Contacts.
Faster panels, five new vPanel tools, a full Services manager in vWHM, and fixes for cron deletion, WordPress installs, backup downloads and more.
Faster: pages that show server or SSL state (vWHM dashboard, Accounts, SSL, Server Setup, Status, Services, account pages) load in a fraction of the time, the Email Deliverability page no longer waits for DNS checks, and on PHP 8.2+ both panels serve several requests at once instead of one after another.
New in vPanel: Optimize Website (compression), Aliases (parked domains), Email disk usage per mailbox, Track Delivery (what happened to each message), and installing your own SSL certificate. Spam Filters now take effect, and "move to folder" filters create the folder.
New in vWHM: the Services page shows and controls every core service — web, database, PHP-FPM, mail, DNS, FTP, brute-force protection, Redis and the panels.
Fixed: cron jobs could not be deleted; a second WordPress install on an account reused the first one's database; scheduled backups could not be downloaded; Git pull failed on current Ubuntu; deleting a subdomain left its HTTPS site live; removing a remote MySQL host did not revoke it; terminating an account left mailbox records that blocked reusing the address; removing an app left its database user; plain http:// panel links now go to https://.
Installer: cron, fail2ban and Dovecot start reliably on minimal images and on servers without IPv6.
The Zone Editor now manages DNS zones served by the server's own nameservers (PowerDNS), not only Cloudflare: add, edit and delete A, AAAA, CNAME, MX, TXT, SRV, NS and CAA records, with changes live at once.
On such zones the Deliverability page's DKIM, SPF and DMARC buttons, "Set up email DNS" and zone import publish straight into the local zone.
Security update: hardens database permissions, backup restores and cPanel imports. Please update as soon as possible; servers with automatic updates on need no action.
Removing an account now also removes all of its database users.
Restores and cPanel imports list any databases they could not import.
Release notes are now a short summary; the detailed changelog is no longer included in the package.
Security update: fixes a weakness that could let the panel's own service account gain root access; existing servers are repaired automatically. Please update.
phpMyAdmin and other vPanel pages open straight away on large accounts, instead of waiting 10 seconds or more for the disk scan.
Open phpMyAdmin signs in reliably in one tab, without phpMyAdmin's configuration banners.
vPanel Terminal works again; since 5.40 every command was rejected.
vWHM Resources shows saved disk figures at once and says "calculating…" or why a figure is unavailable.
Fixed the vWHM Update button, which refused updates with "update signature is invalid".
Servers on 5.44 or older need to run the installer once to get this fix: curl -fsSL https://get.vantapanel.com | sudo bash. After that the Update button works.
Updates now restart the panels, so changes take effect straight away.
Security update: stronger separation between hosting accounts and safer panel sessions. Please update as soon as possible.
PHP isolation now covers every website of an isolated account, and new accounts are isolated by default on fresh installs.
Accounts isolated before this update keep working exactly as before and are listed as partially isolated; complete them under vWHM → MultiPHP / Isolation.
vWHM → Security: choose whether /vwhm opens on customer domains (off on fresh installs, unchanged on upgrades).
Servers on 5.39 or 5.40 update by running the installer again: curl -fsSL https://get.vantapanel.com | sudo bash
Usually you do nothing: with automatic updates on, the default, the panel installs a newer signed release by itself within a day and emails you the result. To update now, open vWHM → Updates and click Install, or run the install command again; both keep your data.
Signed and checked first
The package’s SHA-256 and its Ed25519 signature are verified before anything changes, the current install is backed up, and an older version is never installed. How releases are verified
Security advisories in vWHM
vWHM → Updates lists every published advisory that affects the version you run, and the dashboard warns about critical and high ones. All security advisories
The latest version is Vanta Panel 5.55, released on 22 October 2026. vWHM now shows Vanta Panel security advisories: Updates lists every published advisory that affects the version you run, and the dashboard warns about critical and high ones.
How do I update Vanta Panel?
Automatic updates are on by default: the panel checks get.vantapanel.com and installs a newer signed release once a day. To update straight away, open vWHM, go to Updates and click Install, or run the install command again on the server; it upgrades in place and keeps your data.
Are Vanta Panel updates signed?
Yes. Every release is signed with Vanta Panel's Ed25519 release key. The installer and the in-panel updater check the package's SHA-256 and the signature before they change anything, and the updater never installs an older version.
How do I know if a release fixes a security problem?
Security releases are marked on this page and link to their advisory. Each advisory has an ID such as VP-2026-001, a severity, the versions it affects, the version that fixes it and what to do. vWHM also lists, under Updates, the advisories that affect the version you run.
How do I follow new Vanta Panel releases?
Subscribe to the release feed at vantapanel.com/releases/feed.xml in any feed reader, or read the machine-readable list at get.vantapanel.com/releases.json. Security advisories have their own feed at vantapanel.com/security/advisories/feed.xml.
Run the latest release. Signed, every time.
Install Vanta Panel on your own VPS with one command; it keeps itself up to date from then on.
