Threats affecting pkg:composer/softaculous/virtualizor

CVE-2026-43642 is a critical PHP object injection vulnerability in Softaculous Virtualizor before versions 3.2.9 (Patch 9) and 3.0.0. It affects the billing module handler, allowing unauthenticated remote attackers to supply arbitrary serialized PHP objects via the billing_data POST field. This leads to unsafe deserialization without allowed_classes restrictions, enabling remote code execution as root.