Security advisory · VP-2026-001
PHP isolation did not cover every website of an isolated account
On accounts set to run PHP in their own isolated pool, isolation did not apply to every website of the account, so the separation between accounts was weaker than the setting showed. Vanta Panel 5.41 applies it to every website of an isolated account.
- Severity
- Medium
- Affected
- Vanta Panel versions before 5.41
- Fixed in
- Vanta Panel 5.41
- Component
- Account isolation (PHP-FPM)
- Published
Who is affected?
Servers where accounts were switched to isolated PHP before 5.41. Code running on one of those websites, such as a compromised site, was not always limited to the account's own Linux user.
Affected: Vanta Panel versions before 5.41. Fixed in Vanta Panel 5.41.
What should I do?
Update to Vanta Panel 5.41 or later. Accounts isolated before 5.41 keep their previous setup and are listed as partially isolated under vWHM, MultiPHP / Isolation: click Complete isolation there, then check those accounts' sites.
To see which version a server runs, open vWHM: the version is shown under Updates and at the bottom of every page. Updates lists every published advisory that affects that version.
Is the fix installed automatically?
Partly. New and newly isolated accounts are fully isolated. Accounts isolated before 5.41 are left exactly as they were, so no site changes behaviour unexpectedly, until you click Complete isolation.
Credit
Found in Vanta Panel's own security review.
References
Found a security problem in Vanta Panel?
Email security@vantapanel.com privately rather than opening a public issue. How to report a vulnerability.
Questions about VP-2026-001
Something else? Ask support or read the docs.
Which Vanta Panel versions are affected by VP-2026-001?
Vanta Panel versions before 5.41 that have not installed the fix. It is fixed in Vanta Panel 5.41.
What should I do about VP-2026-001?
Update to Vanta Panel 5.41 or later. Accounts isolated before 5.41 keep their previous setup and are listed as partially isolated under vWHM, MultiPHP / Isolation: click Complete isolation there, then check those accounts' sites.
Is the fix for VP-2026-001 installed automatically?
Partly. New and newly isolated accounts are fully isolated. Accounts isolated before 5.41 are left exactly as they were, so no site changes behaviour unexpectedly, until you click Complete isolation.
Other advisories
VP-2026-007Criticalfixed in 5.54
Critical PHP vulnerabilities CVE‑2026‑109618 and CVE‑2026‑109619
VP-2026-006Mediumfixed in 5.52
Some removed database hosts and subdomains stayed active
VP-2026-005Highfixed in 5.50
Backup restores and cPanel imports could reach other accounts' data
Keep every server on the latest release.
Automatic updates are on by default: each signed release installs itself within a day, and vWHM warns about any advisory that affects the version you run.
curl -fsSL https://get.vantapanel.com | sudo bash