Virtualizor: Critical PHP Vulnerabilities Patched

Dear Customer,

On October 21, 2026, the PHP project fixed two critical vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They let an attacker run code on a server remotely without logging in, and attacks are already happening. We have patched EMPS, the PHP stack that runs the Virtualizor panel, with the official fix and released it as EMPS 5.6.

Both vulnerabilities are rated critical (CVSS 9.2) and affect almost every PHP version from 5.4 to 8.5, including the PHP bundled with Virtualizor.

Because these vulnerabilities are already being exploited, we strongly recommend applying this update right away. If you need help, please contact our support team.