One Virtualmin server, many PHP versions to patch.
Virtualmin itself is built on Perl, but every virtual server it manages runs PHP. A typical box has several PHP versions installed side by side, and each one, with every FPM pool using it, needs the fix.
Is the PHP Virtualmin servers runs on affected?
Run php -v on the server. A patched version on disk only protects you after every PHP worker restarts. Distro packages can carry backported fixes under older version numbers, so we confirm against your vendor's changelog.
What makes these sites a target.
Several PHP versions per server
Different domains often run different PHP versions from distro packages or third-party repositories. Patching the default leaves the others exposed.
A pool per domain
Each virtual server has its own PHP-FPM pool or FCGI process, and all of them keep old code until they restart.
Old versions kept for one client
PHP 7.x or 8.0 often stays installed for a single legacy site. Those versions get no fix.
One breach reaches every domain
A takeover through one site can reach every other site, mailbox and database on the server.
How we fix it on Virtualmin servers.
The first commands we run, read-only:
ls /etc/php/ 2>/dev/null; ls /etc/opt/remi/ 2>/dev/null systemctl list-units --type=service | grep -i fpm for b in /usr/bin/php*; do echo "$b: $($b -v | head -1)"; done
Inventory
We list every installed PHP version and which virtual servers use each one.
Patch or retire
We update supported branches to patched releases and move domains off end-of-life versions after testing them.
Restart every pool
We restart each php-fpm service and the web server, then confirm no worker predates the patch.
Harden and isolate
We set safe php.ini defaults per version, make sure each domain's PHP runs as its own user, and add edge rules.
Any cloud, any VPS, any server.
The fix is the same everywhere: a patched PHP build, restarted workers and hardened settings. We work on VMs, containers, Kubernetes, serverless runtimes and control-panel hosting.
Pick how much you want us to do.
Exposure check
- Every PHP version and server you run, listed
- Clear verdict: exposed or not, and how urgent
- Written report with next steps
Fixed fee, credited toward remediation
Guided remediation
- Upgrade plan for your platform and hosting
- Temporary hardening while you wait
- Edge and WAF rules written for your routes
- We review your team's work and verify it
Hourly or fixed package
Full repair and upgrade
- Staging test, upgrade and rollback plan
- Patched PHP on every server and container
- All workers restarted and verified
- Hardening, monitoring and a closing report
Fixed quote per environment
Patch watch
- We track PHP and platform advisories
- Quarterly version and config checks
- Priority response for the next critical CVE
Monthly retainer
From first call to verified fix.
Authorize
You sign a short scope and authorization. We don't scan or touch any system without it.
Inventory
We record every PHP version, server, container and worker process in scope.
Plan
You get a fixed quote, a schedule and a rollback plan before any change.
Patch and restart
We upgrade PHP and restart every worker so no vulnerable code stays in memory.
Verify
We confirm the fix on every host and hand over a written report.
Don't restart the server yet.
If you see shells or tools like curl launched by PHP processes, PHPSESSID cookies longer than 256 bytes, or a spike in PHP worker crashes, contact us before you patch. Restarting wipes the memory evidence that shows what an attacker did. We preserve that evidence first, then work with an incident response firm if the investigation needs one.
Virtualmin servers questions.
Do I need to update Webmin or Virtualmin?
Keep them current, but they aren't the vulnerable part. The fix is the PHP packages they manage.
Some clients need PHP 7.4.
We'll find what blocks each site from moving to 8.2+ and help you plan the move. Until then we harden and isolate those sites.
Can you handle many servers at once?
Yes. We script the inventory and patch rollout across a fleet and give you a report per server.
Find out where you stand this week.
Tell us what you run on Virtualmin servers and where it's hosted. We'll reply within one business day with a time for the exposure check.
Include your platform, approximate number of sites or servers, and your hosting provider.