Loading story…
Acronis has warned that CVE-2026-87886, a high-severity local privilege-escalation flaw (CVSS 7.8) in its Linux Backup plugin for cPanel & WHM and Backup extension for Plesk, has seen limited, targeted exploitation. Caused by insecure file permissions (CWE-276), the vulnerability lets an attacker who already has low-privileged local access elevate privileges without user interaction, potentially exposing or modifying backup data and system files or taking control of the hosting server.
Shared-hosting deployments face particular risk because a compromised tenant account could become a foothold for attacks against other customer accounts, services, and control-panel infrastructure. Acronis fixed the issue in cPanel & WHM plugin version 1.9.3 HF3 and Plesk extension version 1.8.11; administrators should update immediately and investigate affected systems for persistence or compromise artifacts, as patching prevents new exploitation but does not remove an existing attacker.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
Acronis disclosed CVE-2026-87886, a CVSS 7.8 local privilege-escalation flaw caused by insecure file permissions in its Linux cPanel & WHM and Plesk backup integrations. It fixed affected products in Backup plugin for cPanel & WHM version 1.9.3 HF3 and Backup extension for Plesk version 1.8.11, urging administrators to update immediately.
Acronis reported limited, targeted in-the-wild exploitation of CVE-2026-87886 against its Backup plugin for cPanel & WHM. Its assessment was based on a single report from a potentially affected customer, and the scale of exploitation remains unknown.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourceheise.de
Open sourcebleepingcomputer.com
Open sourcesecurity-advisory.acronis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
cPanel has patched **CVE-2026-65643**, a critical flaw in cPanel & WebHost Manager (WHM) domain-parking and addon-domain functionality. A low-privileged authenticated hosting account authorized to add parked or addon domains can create arbitrary files on the underlying server, potentially leading to code execution as `root` and full control of the host. The issue affects all supported cPanel & WHM release branches, with fixes issued for 11.110, 11.134, 11.136, and 11.138, including WP Squared. Shared and reseller-hosting operators should apply the relevant patched build immediately; systems on end-of-life branches must be upgraded to a supported release, and unpatched deployments should restrict parked- and addon-domain permissions. cPanel had not disclosed a CVSS score, detection guidance, interim mitigation, or confirmed in-the-wild exploitation.
Sep 1, 2026
WebPros cPanel disclosed and patched a critical authentication bypass flaw in **cPanel & WHM** and **WP Squared**, now tracked as `CVE-2026-41940` with a **CVSS 9.8** score. The bug affects all supported cPanel & WHM versions after `11.40` prior to fixed releases, and reporting indicates some unsupported versions are likely vulnerable as well. Researchers said the issue stems from improper session handling tied to a **CRLF injection** in the login flow, allowing unauthenticated remote attackers to poison session data and gain administrator or root-level access to exposed hosting control panels. cPanel released emergency updates across supported branches, published detection guidance, and advised administrators to force updates, restart `cpsrvd`, and investigate session files and logs for signs of compromise. Multiple sources reported the flaw was **actively exploited in the wild** before patches were issued, with hosting providers such as **Namecheap** and **KnownHost** taking emergency action by restricting access to management ports like `2083` and `2087` while deploying fixes. **CISA** added `CVE-2026-41940` to its **Known Exploited Vulnerabilities** catalog and ordered federal agencies to remediate quickly, while national cyber agencies in Canada, Austria, and Belgium also warned of the risk. Public technical analysis, proof-of-concept code, and exploit tooling released after disclosure increased the likelihood of broad opportunistic attacks against internet-exposed cPanel systems, which researchers estimated number in the hundreds of thousands to more than a million, raising the risk of website compromise, credential theft, ransomware, phishing, and multi-tenant hosting breaches.
Sep 3, 2026
A critical authentication bypass flaw, tracked as **`CVE-2026-41940`**, affects **cPanel & WHM** and **WP Squared** deployments and has been publicly reported as under active exploitation. The vulnerability can let unauthenticated remote attackers bypass normal login controls in certain conditions and potentially obtain administrative access to internet-facing hosting systems that manage websites, databases, email, DNS, SSL certificates, and customer accounts. Guidance tied to the disclosure urges organizations to apply vendor-patched builds immediately and investigate for signs of compromise, as a successful breach could expose downstream environments and sensitive business data. Recommended response actions include isolating affected servers, rotating credentials, removing attacker persistence, and rebuilding compromised systems, alongside longer-term hardening such as **MFA**, network segmentation, reduced internet exposure, tighter privileged access, and continuous vulnerability monitoring.
Jun 29, 2026