Loading story…
cPanel published security advisories SEC-73728 and SEC-73755 covering vulnerabilities in cPanel & WHM and WP Squared, prompting follow-on guidance from the Canadian Centre for Cyber Security. The advisories affect multiple cPanel & WHM releases, including 11.86.0.45, 11.94.0.32, 11.102.0.43, 11.110.0.120 (cl6110), 11.110.0.121, 11.118.0.68, 11.124.0.41, 11.126.0.62, 11.130.0.26, 11.132.0.35, 11.134.0.29, and 11.136.0.13, along with WP Squared 11.136.1.16 and earlier.
Canada’s Cyber Centre advised administrators to review both vendor bulletins and apply the required patches to exposed systems. The notices indicate that organizations running affected hosting management platforms and WordPress management components should prioritize updates across supported branches to remediate the disclosed flaws.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-21, cPanel published new security advisories addressing vulnerabilities in cPanel & WHM, WP Squared, and EasyApache4. The advisories identified affected release lines including cPanel & WHM 11.126.0.63+, 11.134.0.30+, 11.136.0.14+, WP Squared 11.138.1.1+, and EasyApache4 versions prior to 25.62, and referenced CVE-2026-33278 and a cpanel-unbound 1.25.1 security release.
On 2026-05-20, the Canadian Centre for Cyber Security published advisory AV26-488 referencing cPanel's May 19 security advisories. It urged administrators to review the advisories and apply the necessary updates.
On 2026-05-19, cPanel published security advisories SEC-73728 and SEC-73755 for vulnerabilities affecting cPanel & WHM and WP Squared. The advisories covered affected cPanel & WHM versions through 11.136.0.13 and WP Squared 11.136.1.16 and prior.
On 2026-05-11, cPanel disclosed and patched three vulnerabilities affecting cPanel & WHM and WP Squared: CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203. The flaws included path traversal, Perl code injection, and symlink-handling privilege escalation issues that could be chained for full server compromise from an authenticated shared-hosting account.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecyber.gc.ca
Open sourcesupport.cpanel.net
Open sourcesupport.cpanel.net
Open sourcethecybersecguru.com
Open sourceinfosec.exchange
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
cPanel disclosed and patched a critical authentication bypass in cPanel & WHM, tracked as **`CVE-2026-41940`**, after reports of active in-the-wild exploitation against hosting infrastructure. The flaw affects authentication paths in supported versions and can let unauthenticated attackers reach administrative interfaces, forge authenticated sessions, and potentially gain control of hosted websites, databases, email accounts, and server configuration. Government and industry alerts warned that shared hosting environments face outsized risk because a single compromised server can expose many downstream customer sites, and some providers temporarily restricted cPanel and WHM login ports while applying fixes. Public technical analysis and a GitHub proof-of-concept described an exploit chain involving manipulated HTTP headers and session cookie handling to create forged privileged sessions, including possible root-level WHM access. Separately, cPanel also patched three additional vulnerabilities in cPanel & WHM and **WP Squared**—**`CVE-2026-29201`**, **`CVE-2026-29202`**, and **`CVE-2026-29203`**—that enable arbitrary file read through path traversal, Perl code injection leading to remote code execution, and denial-of-service via unsafe symlink handling. The most severe of the newly disclosed flaws, **`CVE-2026-29202`**, affects the `create_user` API and can allow arbitrary Perl code execution on the server, reinforcing calls for immediate upgrades, restricted access to management interfaces, and log review for suspicious authorization and cookie activity.
Jun 29, 2026
WebPros cPanel disclosed and patched a critical authentication bypass flaw in **cPanel & WHM** and **WP Squared**, now tracked as `CVE-2026-41940` with a **CVSS 9.8** score. The bug affects all supported cPanel & WHM versions after `11.40` prior to fixed releases, and reporting indicates some unsupported versions are likely vulnerable as well. Researchers said the issue stems from improper session handling tied to a **CRLF injection** in the login flow, allowing unauthenticated remote attackers to poison session data and gain administrator or root-level access to exposed hosting control panels. cPanel released emergency updates across supported branches, published detection guidance, and advised administrators to force updates, restart `cpsrvd`, and investigate session files and logs for signs of compromise. Multiple sources reported the flaw was **actively exploited in the wild** before patches were issued, with hosting providers such as **Namecheap** and **KnownHost** taking emergency action by restricting access to management ports like `2083` and `2087` while deploying fixes. **CISA** added `CVE-2026-41940` to its **Known Exploited Vulnerabilities** catalog and ordered federal agencies to remediate quickly, while national cyber agencies in Canada, Austria, and Belgium also warned of the risk. Public technical analysis, proof-of-concept code, and exploit tooling released after disclosure increased the likelihood of broad opportunistic attacks against internet-exposed cPanel systems, which researchers estimated number in the hundreds of thousands to more than a million, raising the risk of website compromise, credential theft, ransomware, phishing, and multi-tenant hosting breaches.
Sep 3, 2026
cPanel released fixes for three vulnerabilities that break tenant isolation on shared-hosting servers. **CVE-2026-87899** allows an authenticated cPanel account holder to escalate privileges and execute code as `root`, potentially taking control of the entire host; **CVE-2026-68490** exposes other accounts’ CalDAV/CardDAV calendar events and contacts through incorrect permissions. Both affect cPanel & WHM version 120 and later. A separate WP Toolkit vulnerability, **CVE-2026-87900**, enables a logged-in cPanel user to modify databases belonging to other cPanel accounts. cPanel has issued fixed builds, but no temporary mitigations were provided for the CalDAV/CardDAV issues and no exploitation has been reported. Administrators should urgently update cPanel/WHM and WP Toolkit, particularly on public multi-tenant deployments, and investigate anomalous cross-account access or database changes.
Sep 24, 2026