CVE-2026-43642 Overview
CVE-2026-43642 is a PHP object injection vulnerability in Softaculous Virtualizor, a virtual machine management panel used by hosting providers. The flaw resides in the billing module handler and allows unauthenticated remote attackers to submit arbitrary serialized PHP objects for deserialization. Successful exploitation of an available Property-Oriented Programming (POP) chain yields remote code execution as root. The issue is tracked as an insecure deserialization weakness under [CWE-502].
Critical Impact
Unauthenticated attackers can achieve remote code execution as root on affected Virtualizor installations by sending a crafted HTTP POST request to the billing module handler.
Affected Products
- Softaculous Virtualizor versions prior to 3.2.9 (Patch 9)
- Softaculous Virtualizor 3.0.0
- Deployments exposing the billing module handler to untrusted networks
Discovery Timeline
- 2026-09-22 - CVE-2026-43642 published to the National Vulnerability Database
- 2026-09-22 - Last updated in the NVD database
Technical Details for CVE-2026-43642
Vulnerability Analysis
The vulnerability lives in Virtualizor's billing module handler. When the act request parameter is set to login and the from_billing_module parameter is present, the handler reads the billing_data POST field and passes its contents directly to PHP's unserialize() function. The call is made without an allowed_classes restriction, so any class loaded by the application can be instantiated during deserialization.
Attackers who identify a suitable POP chain within Virtualizor or its bundled dependencies can trigger magic methods such as __wakeup() or __destruct() to reach dangerous sinks. Because the Virtualizor daemon runs with elevated privileges, code executed through the chain inherits root on the host operating system. See the VulnCheck advisory and the VulnCheck technical blog for a full walkthrough.
Root Cause
The root cause is unsafe use of unserialize() on attacker-controlled input. PHP deserialization inherently instantiates classes and invokes lifecycle methods, and the missing allowed_classes option leaves every declared class reachable. The billing hook also lacks authentication and origin validation, so the vulnerable path is accessible before session establishment.
Attack Vector
Exploitation requires a single HTTP POST request to the Virtualizor endpoint carrying act=login, the from_billing_module marker, and a serialized POP chain in the billing_data field. No credentials, tokens, or prior interaction are required. Successful requests execute attacker-supplied commands with root privileges, enabling full host compromise, credential theft, and pivot into managed virtual machines.
No public exploit code has been catalogued in ExploitDB at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the VulnCheck blog for exploitation mechanics.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-43642
Indicators of Compromise
- POST requests to Virtualizor endpoints containing act=login together with from_billing_module parameters from unexpected sources.
- Request bodies with a billing_data field whose value begins with PHP serialization markers such as O:, a:, or s:.
- New root-owned processes spawned by the Virtualizor PHP worker, including shells, curl, wget, or reverse-shell binaries.
- Unexpected outbound network connections initiated by the Virtualizor service host shortly after billing-hook requests.
Detection Strategies
- Inspect web server access logs for the act=login and from_billing_module parameter combination, especially from non-billing source addresses.
- Alert on unserialize()-related PHP errors or class-not-found warnings in Virtualizor logs, which often accompany POP chain probing.
- Correlate billing-hook requests with subsequent process creation events on the Virtualizor host to identify chained exploitation.
Monitoring Recommendations
- Forward Virtualizor web and application logs to a centralized SIEM for retention and correlation.
- Baseline normal parent-child process trees for the PHP-FPM or Apache worker running Virtualizor and alert on deviations.
- Monitor egress traffic from the Virtualizor management host and restrict it to known billing and update destinations.
How to Mitigate CVE-2026-43642
Immediate Actions Required
- Upgrade Virtualizor to version 3.2.9 (Patch 9) or 3.3.0 as documented in the Virtualizor 3.2.9 release notes and the Virtualizor 3.3.0 launch announcement.
- Restrict network access to the Virtualizor management interface so only trusted billing systems and administrators can reach it.
- Review web and system logs for prior requests matching the billing-hook exploitation pattern and investigate any suspicious root process activity.
Patch Information
Softaculous addressed the deserialization flaw in Virtualizor 3.2.9 (Patch 9) and included the fix in the 3.3.0 release. Administrators should apply the update through the standard Virtualizor upgrade path and confirm the running version after installation. Both vendor advisories are linked in the release notes above.
Workarounds
- Place the Virtualizor management endpoint behind a VPN or IP allowlist until the patch is applied.
- Configure a web application firewall rule to block POST requests that include both act=login and from_billing_module with a billing_data body.
- Disable the billing module integration if it is not actively used by the hosting environment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
