Virtualizor: Critical PHP Vulnerabilities Patched

Published 22 October 2026 2 min read

Dear Customer,

On October 21, 2026, the PHP project fixed two critical vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They let an attacker run code on a server remotely without logging in, and attacks are already happening. We have patched EMPS, the PHP stack that runs the Virtualizor panel, with the official fix and released it as EMPS 5.6.

Security Update

PHP2Shell patched in EMPS 5.6

Both vulnerabilities are rated critical (CVSS 9.2) and affect almost every PHP version from 5.4 to 8.5, including the PHP bundled with Virtualizor.

Vulnerability

Remote Code Execution in PHP

Two memory-handling flaws in PHP let an unauthenticated attacker run code on any server where PHP handles web requests, including PHP-FPM.

✓

Fixed

Patched EMPS 5.6

EMPS 5.6 includes the PHP security team's official patch for both vulnerabilities, covering the panel's PHP-FPM, PHP-CGI and cron PHP.

Action Required

Update Virtualizor to 3.3.0.5

Update to Virtualizor 3.3.0.5

Please update Virtualizor to version 3.3.0.5 on your master and all slave servers. The update will automatically upgrade EMPS to the patched version 5.6.

Because these vulnerabilities are already being exploited, we strongly recommend applying this update right away. If you need help, please contact our support team.

Explore Virtualizor