Security Advisories
Security issues in the host operating system can affect VirtFusion hypervisors regardless of the VirtFusion application version. Check the running kernel and the vendor's security updates on each host.
- PHP critical vulnerabilities (October 2026): critical PHP core vulnerabilities affecting every control server and hypervisor, with the status of VirtFusion's 8.3.36 packages and how to update.
- PwnEscape (CVE-2026-99999): Linux host networking exposure through virtio-net/TAP VMs. The advisory includes vendor patch status checked on 30 October 2026, remediation and interim exposure reduction.
PwnEscape timeline
| Date | Event |
|---|---|
| 2026-10-08 | Upstream fix committed: validate checksum positioning before IPv4 checksum completion. |
| 2026-10-15 | CVE-2026-99999 published and PwnEscape publicly disclosed. |
| 2026-10-16 | Debian 13 fix confirmed available in the security repository: 6.12.113-1, DSA-6568-1, for amd64 and arm64. |
| 2026-10-18 | Debian 12 fix confirmed available in the security repository: 6.1.190-1, DLA-4841-1, for amd64 and arm64. |
| 2026-10-30 | Fixes confirmed in stable BaseOS repositories for AlmaLinux and Rocky Linux 9 (5.14.0-687.59.1.el9_8) and 10 (6.12.0-211.67.1.el10_2), for x86_64 and aarch64. See the vendor advisories. |
See the advisory's distribution fix availability table for the latest checked status.