Security advisory · VP-2026-007
Critical PHP vulnerabilities CVE‑2026‑109618 and CVE‑2026‑109619
Two critical vulnerabilities in PHP itself, published by the PHP project on 21 October 2026, let an attacker with no account run code on a server through PHP. Vanta Panel 5.54 installs the fixed PHP packages and restarts every PHP process, the panels included, because running processes keep using the old code until they restart.
- Severity
- Critical
- Affected
- Vanta Panel 5.53 and earlier
- Fixed in
- Vanta Panel 5.54
- Component
- PHP (operating system packages)
- Published
Who is affected?
Any server running a PHP 8.2, 8.3, 8.4 or 8.5 build without the fix, or a PHP 8.1 build without its distribution's fix. The PHP project rates both 9.2 (critical); no sign-in is needed. Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; in Ubuntu 24.04 by 8.3.6-0ubuntu0.24.04.13 and Ubuntu 22.04 by 8.1.2-1ubuntu2.28; in Debian 12 by 8.2.35-1~deb12u1 and Debian 13 by 8.4.27-1~deb13u1.
Affected: Vanta Panel 5.53 and earlier. Fixed in Vanta Panel 5.54.
What should I do?
Update to Vanta Panel 5.54 or later, then check vWHM, PHP Security: every PHP version should show as patched. If you cannot update the panel yet, install your distribution's PHP security updates and restart PHP-FPM, Apache and both panels.
To see which version a server runs, open vWHM: the version is shown under Updates and at the bottom of every page. Updates lists every published advisory that affects that version.
Is the fix installed automatically?
Yes. Servers with automatic updates on install 5.54 within a day; 5.54 installs the PHP fixes and restarts PHP right away, and from then on installs PHP security updates every day while automatic PHP patching is on (the default).
References
Found a security problem in Vanta Panel?
Email security@vantapanel.com privately rather than opening a public issue. How to report a vulnerability.
Questions about VP-2026-007
Something else? Ask support or read the docs.
Which Vanta Panel versions are affected by VP-2026-007?
Vanta Panel 5.53 and earlier that have not installed the fix. It is fixed in Vanta Panel 5.54.
Is Vanta Panel affected by CVE-2026-109618 and CVE-2026-109619?
Any server running a PHP 8.2, 8.3, 8.4 or 8.5 build without the fix, or a PHP 8.1 build without its distribution's fix. The PHP project rates both 9.2 (critical); no sign-in is needed. Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; in Ubuntu 24.04 by 8.3.6-0ubuntu0.24.04.13 and Ubuntu 22.04 by 8.1.2-1ubuntu2.28; in Debian 12 by 8.2.35-1~deb12u1 and Debian 13 by 8.4.27-1~deb13u1. Fixed in Vanta Panel 5.54.
What should I do about VP-2026-007?
Update to Vanta Panel 5.54 or later, then check vWHM, PHP Security: every PHP version should show as patched. If you cannot update the panel yet, install your distribution's PHP security updates and restart PHP-FPM, Apache and both panels.
Is the fix for VP-2026-007 installed automatically?
Yes. Servers with automatic updates on install 5.54 within a day; 5.54 installs the PHP fixes and restarts PHP right away, and from then on installs PHP security updates every day while automatic PHP patching is on (the default).
Other advisories
VP-2026-006Mediumfixed in 5.52
Some removed database hosts and subdomains stayed active
VP-2026-005Highfixed in 5.50
Backup restores and cPanel imports could reach other accounts' data
VP-2026-004Highfixed in 5.50
Database permissions could reach another account's databases
Keep every server on the latest release.
Automatic updates are on by default: each signed release installs itself within a day, and vWHM warns about any advisory that affects the version you run.
curl -fsSL https://get.vantapanel.com | sudo bash