Loading story…
cPanel has patched CVE-2026-67401, an authenticated SQL-injection flaw in its EmailTrack functionality that lets a hosting user with mail-related privileges create arbitrary files and potentially execute code as root. All supported cPanel & WHM versions are affected, creating particular risk for shared-hosting and multi-tenant deployments where compromise of one eligible account could expose other customers and hosted assets.
Fixed builds are available for release lines 11.110, 11.134, 11.136, 11.138, and WP Squared. Administrators should upgrade immediately, review and minimize mail-related privileges, enforce strong authentication and MFA, and investigate eligible accounts and servers for compromise. cPanel has not disclosed the precise required privileges, exploitation chain, compensating controls, or detection guidance; no public exploit, confirmed active exploitation, CVE Program entry, or CISA KEV listing had been identified as of September 9.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-908 identifying CVE-2026-65638 affecting ConfigServer Security & Firewall versions 14.00 through 16.29 and CVE-2026-65639 affecting versions 2.15 through 16.29. It urged users and administrators to review vendor information and apply available updates.
cPanel disclosed CVE-2026-67401, an authenticated SQL-injection vulnerability in EmailTrack affecting all supported cPanel and WHM versions. A hosting account with mail-related privileges could create arbitrary files and potentially execute code as root; cPanel released fixes for release lines 11.110, 11.134, 11.136, 11.138, and WP Squared.
cPanel disclosed a vulnerability in parked-domain functionality that could result in root-level code execution.
cPanel disclosed a database-related vulnerability that could allow a hosting user with database-function access to execute commands with full administrative privileges.
cPanel previously addressed an authentication-bypass vulnerability that required no user account and was confirmed to have been used in ransomware campaigns; the flaw was listed in CISA's Known Exploited Vulnerabilities catalog.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
csirt.bj
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcethecybersecguru.com
Open sourcemkd-cirt.mk
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
cPanel has patched **CVE-2026-65643**, a critical flaw in cPanel & WebHost Manager (WHM) domain-parking and addon-domain functionality. A low-privileged authenticated hosting account authorized to add parked or addon domains can create arbitrary files on the underlying server, potentially leading to code execution as `root` and full control of the host. The issue affects all supported cPanel & WHM release branches, with fixes issued for 11.110, 11.134, 11.136, and 11.138, including WP Squared. Shared and reseller-hosting operators should apply the relevant patched build immediately; systems on end-of-life branches must be upgraded to a supported release, and unpatched deployments should restrict parked- and addon-domain permissions. cPanel had not disclosed a CVSS score, detection guidance, interim mitigation, or confirmed in-the-wild exploitation.
Sep 1, 2026
cPanel disclosed and patched **CVE-2026-58048**, a critical privilege-escalation flaw in **cPanel & WHM** that allows an authenticated user with **MySQL** or **MariaDB** access to execute arbitrary SQL commands with full database administrator privileges. The bug, rated **CVSS 9.4**, affects all supported cPanel & WHM versions and **WP Squared**, and stems from the database rename process failing to preserve SQL mode correctly, enabling escalation into the database root context. The company warned that in some shared-hosting, database, and operating-system configurations, the flaw could extend beyond database control to **OS-level compromise** and potentially full server takeover. cPanel said customers should upgrade immediately to fixed releases; if patching is delayed, administrators should temporarily revoke the MySQL feature from cPanel users and review database audit logs for suspicious administrative activity. **CISA** said no active exploitation had been observed and classified the issue as non-automatable despite its severe technical impact.
Aug 5, 2026
WebPros cPanel disclosed and patched a critical authentication bypass flaw in **cPanel & WHM** and **WP Squared**, now tracked as `CVE-2026-41940` with a **CVSS 9.8** score. The bug affects all supported cPanel & WHM versions after `11.40` prior to fixed releases, and reporting indicates some unsupported versions are likely vulnerable as well. Researchers said the issue stems from improper session handling tied to a **CRLF injection** in the login flow, allowing unauthenticated remote attackers to poison session data and gain administrator or root-level access to exposed hosting control panels. cPanel released emergency updates across supported branches, published detection guidance, and advised administrators to force updates, restart `cpsrvd`, and investigate session files and logs for signs of compromise. Multiple sources reported the flaw was **actively exploited in the wild** before patches were issued, with hosting providers such as **Namecheap** and **KnownHost** taking emergency action by restricting access to management ports like `2083` and `2087` while deploying fixes. **CISA** added `CVE-2026-41940` to its **Known Exploited Vulnerabilities** catalog and ordered federal agencies to remediate quickly, while national cyber agencies in Canada, Austria, and Belgium also warned of the risk. Public technical analysis, proof-of-concept code, and exploit tooling released after disclosure increased the likelihood of broad opportunistic attacks against internet-exposed cPanel systems, which researchers estimated number in the hundreds of thousands to more than a million, raising the risk of website compromise, credential theft, ransomware, phishing, and multi-tenant hosting breaches.
Sep 3, 2026