Disclosed · dated · signed
Vanta Panel security advisories
7 published advisories. Each one says which versions are affected, which release fixes it and what to do. The newest is VP-2026-007 (critical), fixed in Vanta Panel 5.54.
All advisories
-
VP-2026-007Critical fixed in 5.54CVE-2026-109618, CVE-2026-109619
Critical PHP vulnerabilities CVE‑2026‑109618 and CVE‑2026‑109619
Two critical vulnerabilities in PHP itself, published by the PHP project on 21 October 2026, let an attacker with no account run code on a server through PHP. Vanta Panel 5.54 installs the fixed PHP packages and restarts every PHP process, the panels included, because running processes keep using the old code until they restart.
-
VP-2026-006Medium fixed in 5.52
Some removed database hosts and subdomains stayed active
A remote database host removed from an account kept its database access, and a deleted subdomain kept serving its HTTPS site. Vanta Panel 5.52 removes both completely.
-
VP-2026-005High fixed in 5.50
Backup restores and cPanel imports could reach other accounts' data
Restoring a backup, or importing a cPanel backup in vWHM, could affect databases and database users outside the account being restored. Vanta Panel 5.50 limits restores and imports to the account's own databases and database users.
-
VP-2026-004High fixed in 5.50
Database permissions could reach another account's databases
In some cases, database access the panel gave one hosting account also applied to databases of another account on the same server. Vanta Panel 5.50 corrects how database permissions are granted and repairs existing ones automatically.
-
VP-2026-003High fixed in 5.49
The panel's unprivileged service account could gain root access
On versions up to 5.48, someone who already controlled the panel's own unprivileged service account could gain full control of the server. Vanta Panel 5.49 removes the cause and repairs existing installations on its first run.
-
VP-2026-002Medium fixed in 5.41
Cross-site request protection did not apply in some panel sessions
The panels' protection against cross-site request forgery did not apply in some sessions. In those sessions a web page opened by a panel user could have sent requests to the panel on that user's behalf. Vanta Panel 5.41 applies the protection in every session.
-
VP-2026-001Medium fixed in 5.41
PHP isolation did not cover every website of an isolated account
On accounts set to run PHP in their own isolated pool, isolation did not apply to every website of the account, so the separation between accounts was weaker than the setting showed. Vanta Panel 5.41 applies it to every website of an isolated account.
Disclosure
How are security fixes disclosed?
An advisory is published with the release that fixes the problem. It says what was fixed, which versions are affected, what to do and whether the fix installs itself, and never how the problem could be used, because servers that have not updated are still exposed. Release notes mark every security release.
Signed, like releases
advisories.jsonis signed with the Ed25519 release key; installed panels verify the signature before they show an advisory. How releases are verifiedShown where you will see it
vWHM → Updates lists the advisories that affect the version you run, the dashboard warns about critical and high ones, and alert emails include them.
Fixed by updating
Every advisory names the release that fixes it. With automatic updates on, the default, that release installs itself within a day. Release history
Third-party software too
When the problem is in software the panel runs, such as PHP, the advisory lists its CVE IDs and the official sources, and what the panel does about it.
Questions about security advisories
Something else? Ask support or read the docs.
Where are Vanta Panel security advisories published?
On this page, as an Atom feed at vantapanel.com/security/advisories/feed.xml, and as a machine-readable list at get.vantapanel.com/advisories.json, signed with the same Ed25519 key as releases. Installed panels download the signed list and show, under vWHM → Updates, the advisories that affect the version they run.
How do I know if my server is affected?
Open vWHM → Updates: it lists every published advisory that affects the installed version, and the dashboard shows a warning for critical and high ones. Each advisory also names the affected versions and the version that fixes it.
Why do advisories not explain how the problem works?
Servers that have not installed the fix are still exposed, so an advisory says what was fixed, who is affected and what to do, and nothing that would help someone attack a server that has not updated yet.
How are severities rated?
Critical: can be used from the internet without signing in to take over a server or its data; update at once. High: serious, but needs a sign-in or unusual conditions. Medium: limited impact. Low: hardening or minor exposure. Problems in third-party software such as PHP also list the CVE IDs.
How do I report a security problem in Vanta Panel?
Email security@vantapanel.com privately, with the version, what you found and the steps to reproduce it, and please do not open a public issue. Reports are acknowledged, fixed and credited if you would like.
Security you can check. Advisories you can verify.
Install Vanta Panel on your own VPS with one command; signed updates and advisories reach it automatically.
curl -fsSL https://get.vantapanel.com | sudo bash