Security Advisories
This section documents security issues that affect VirtFusion hypervisors, with patch status for the Linux distributions VirtFusion supports (Debian 12/13, Ubuntu 22.04/24.04, AlmaLinux 9/10, and Rocky Linux 9/10). Each advisory explains what the issue is, whether your hosts are affected, how to patch, and how to mitigate in the meantime.
PHP critical vulnerabilities (October 2026)
PHP critical vulnerabilities (October 2026) affect every control server and every hypervisor, because VirtFusion runs on its own PHP packages. PHP 8.3.36, released on 21 October 2026, fixes two critical vulnerabilities in PHP core (CVE-2026-109618 and CVE-2026-109619). VirtFusion's vf-php8 and vf-system-php8 8.3.36 packages are available for every supported system, with vf-nginx 1.30.6 in the same update. See the advisory for the status of each package and the update steps.
PwnEscape: host networking exposure
PwnEscape (CVE-2026-99999) affects Linux host networking reachable through virtio-net/TAP VMs. It applies to affected hosts with nested virtualization enabled or disabled. See the advisory for the 18 October 2026 vendor-status snapshot, host kernel remediation and the limits of interim measures.
PwnEscape timeline
| Date | Event |
|---|---|
| 2026-10-08 | Upstream fix committed: validate checksum positioning before IPv4 checksum completion. |
| 2026-10-15 | CVE-2026-99999 published and PwnEscape publicly disclosed. |
| 2026-10-16 | Debian 13 fix confirmed available in the security repository: 6.12.113-1, DSA-6568-1, for amd64 and arm64. |
| 2026-10-18 | Debian 12 fix confirmed available in the security repository: 6.1.190-1, DLA-4841-1, for amd64 and arm64. |
See the advisory's distribution fix availability table for the latest checked status.
The KVM Escape Trilogy
During 2026, security researcher Hyunwoo Kim (V4bel) disclosed three related VM-to-host escape vulnerabilities in KVM, collectively called "The KVM Escape Trilogy". All three can affect VirtFusion hypervisors, split by CPU architecture:
- Januscape (CVE-2026-53359): x86 (Intel and AMD). A use-after-free in the KVM shadow MMU, present since 2010.
- Zapscape (CVE-2026-64561): x86 (AMD, and Intel under a specific EPT condition). A use-after-free in the KVM shadow MMU.
- ITScape (CVE-2026-46316): arm64 only. A double-free use-after-free in KVM's vGIC-ITS emulation. VirtFusion runs arm64 hypervisors on Debian 12/13, AlmaLinux 9/10, and Rocky Linux 9/10. Debian 12 is not affected (the flaw was introduced after its kernel branched); Debian 13, AlmaLinux, and Rocky Linux are affected and fixed (with one gap: Rocky Linux 10 has no ITScape-specific erratum yet).
Which advisories apply to a given hypervisor depends on its CPU: x86_64 hosts are exposed to Januscape and Zapscape, while arm64 hosts are exposed to ITScape.
KVM Escape Trilogy timeline
Each event below is dated from the upstream commit, the public disclosure, or the vendor advisory. AlmaLinux and Rocky Linux ship the same kernel builds but publish separate advisories on separate dates. As of 2026-08-24, a few gaps remain: Ubuntu 22.04 and 24.04 are fixed for Januscape but not yet for Zapscape; Debian 12's default 6.1 kernel is not yet patched for Zapscape (its linux-6.12 backport is); and Rocky Linux 10 still has no ITScape erratum (see the ITScape advisory).
| Date | Event |
|---|---|
| 2010-08-01 | Januscape flaw introduced in KVM/x86 (roughly 16 years before disclosure) |
| 2024-04-25 | ITScape flaw introduced in KVM/arm64 |
| 2026-06-05 | ITScape fixed in the mainline Linux kernel (CVE-2026-46316) |
| 2026-06-10 | ITScape publicly disclosed |
| 2026-06-16 | Januscape fixed in the mainline Linux kernel (CVE-2026-53359) |
| 2026-06-21 | Debian ships the ITScape fix (DSA-6355-1, trixie 6.12.94-1) |
| 2026-07-02 | AlmaLinux 10 ships the ITScape fix (ALSA-2026:34911) |
| 2026-07-05 | Debian ships the Januscape fix (DSA-6381-1, bookworm 6.1.180-1 / trixie 6.12.95-1) |
| 2026-07-06 | Januscape publicly disclosed; AlmaLinux 9 ships the ITScape fix (ALSA-2026:36018) |
| 2026-07-09 | AlmaLinux ships the Januscape fix (ALSA-2026:36957 for 9, ALSA-2026:36956 for 10) |
| 2026-07-11 | Rocky Linux 9 ships the ITScape fix (RLSA-2026:36018); Rocky Linux 10 ships the Januscape fix (RLSA-2026:36956) |
| 2026-07-13 | Rocky Linux 9 ships the Januscape fix (RLSA-2026:36957) |
| 2026-07-21 | Zapscape fixed in the mainline Linux kernel (CVE-2026-64561) |
| 2026-07-24 | AlmaLinux ships the Zapscape fix (ALSA-2026:45192 for 9, ALSA-2026:45114 for 10) |
| 2026-07-27 | Rocky Linux ships the Zapscape fix (RLSA-2026:45192 for 9, RLSA-2026:45114 for 10) |
| 2026-08-04 | Zapscape publicly disclosed |
| 2026-08-06 | Debian ships the Zapscape fix (DSA-6415-1, trixie 6.12.101-1) |
What to do
For the three KVM Escape Trilogy issues below, the fix is the same: patch the host kernel and reboot. See the per-distribution fixed versions in each advisory. The interim options differ by architecture:
- x86_64 hosts (Januscape, Zapscape): if a fixed kernel is not yet available, disable nested virtualization as an interim mitigation. The full procedure is in each advisory.
- arm64 hosts (ITScape): there is no practical mitigation short of patching, so affected hosts (Debian 13, AlmaLinux 9/10, and Rocky Linux 9/10) should be updated as a priority.
For PwnEscape, follow its host kernel remediation guidance.
Start with the advisory for the issue you are checking:
- PwnEscape (CVE-2026-99999) (host networking)
- Januscape (CVE-2026-53359) (x86)
- Zapscape (CVE-2026-64561) (x86)
- ITScape (CVE-2026-46316) (arm64)