Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-19 | 2 | Disclosure1Patch1 |
| 2026-05-26 | 1 | Disclosure1 |
🚨 CVE-2026-43633 — CVSS 10/10 ██████████ HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/t01pqiy7wi
Post summary
The tweet alerts to a critical deserialization flaw in HestiaCP (CVE‑2026‑43633) with a patch available for affected versions.
🚨 HestiaCP CVE-2026-43633: Unauthenticated root RCE via PHP–Node.js session deserialisation mismatch. Two components share session files but parse them with incompatible parsers. 🔗 https://threataft.com/articles/hestiacp-cve-2026-43633-rce-session-deserialisation #CyberSecurity #ThreatIntel #HestiaCP #CVE202643633 #RCE
Post summary
The post announces a newly discovered unauthenticated root RCE in HestiaCP caused by a PHP–Node.js session deserialization mismatch, linking to an article that likely contains a PoC and detailed discussion.
CVE-2026-43633 HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.j… https://www.cve.org/CVERecord?id=CVE-2026-43633
Post summary
The post reveals a deserialization flaw in HestiaCP 1.9.0–1.9.4 due to a session format mismatch between PHP and Node.js, with no proof‑of‑concept, exploit, or patch information provided.