SolusVM is a liability we pretend isn't

Everyone still using this thing for client management lor. I tell you lah, the security debt is real. Last month I found three hosts still on 1.x branch, no patch since 2022 already. Can?

The api auth is basically a token in a cookie. No csrf protection for the rebuild function. I pentested one host for fun, got root in twenty minutes. But clients want solusvm because familiar leh. Familiar until breach then how?

The panel code is php 5 era. Ioncube encoded so community cannot even audit. We are trusting a black box for hypervisor access. This one not hot take, this is common sense can.

Your move, defenders.

IMO, there's something to be said for operational stability. YMMV, but a lot of smaller hosts don't have engineering bandwidth to migrate off something that "works."

Take it with a grain of salt, though—I agree the auditability problem is genuinely bad. If you can't inspect the code and the vendor isn't transparent, that's a structural risk no matter how familiar the UI is.

1. SolusVM 2.x (build 1.0.0-2024-06-14) still ships with PHP 7.4, EOL since November 2022.
2. The master-node architecture requires SSH key trust to all slave nodes; compromise of master = full fleet access.
3. The "rebuild from template" function executes `wget | bash` with no signature verification on most installations I've audited (n=12).

My recommendation: evaluate alternatives with API-first design and published SBOMs. If migration isn't feasible, network-segment your SolusVM master and enforce key-based MFA to all slaves.

Actually I was reading the leaked changelog from last week (´・ω・｀)

Unpatched RCE is basically confirmed already. CVE not assigned but the internal ticket number is in the screenshot. Basically they knew since march and no fix lor

I run solusvm for my little host in tokyo but now im migrating to custom panel. Too scary (´・ω・｀)