cPanel Patches Critical Vulnerabilities Threatening Shared-Hosting Security On September 22, 2026, cPanel released a security update addressing three critical vulnerabilities that compromise tenant isolation on shared-hosting servers. The most notable flaw, CVE-2026-68490, involves incorrect permissions in cPanel’s CalDAV and CardDAV functionality, allowing local users to access other accounts’ calendars and contacts. While exploitation is limited to read-only access, exposed data such as names, emails, and meeting schedules could fuel phishing or social-engineering attacks. The vulnerability affects cPanel and WHM versions 120 and later, with fixes available in builds 11.134.0.57, 11.136.0.41, 11.138.0.8, and WP Squared 11.138.1.11 or newer. The same update resolves CVE-2026-87899, a severe privilege-escalation bug in CalDAV and CardDAV that enables authenticated users to execute code as root, potentially seizing full server control. Additionally, CVE-2026-87900 impacts WP Toolkit, where a logged-in user could modify databases belonging to other accounts, posing a cross-tenant integrity risk. WP Toolkit versions 6.11.2-10794 and earlier are vulnerable; administrators must upgrade to 6.11.3 or later. cPanel recommends immediate updates via WHM or the command line, followed by verification of installed versions and monitoring for unauthorized cross-user access. The disclosures follow a string of recent cPanel ecosystem flaws, including CVE-2026-65638 (unauthenticated command injection), CVE-2026-67401 (SQL injection leading to root code execution), and CVE-2026-65643 (domain-parking exploit). A separate LiteSpeed Enterprise vulnerability (fixed in version 6.3.7) also allowed low-privileged users to bypass tenant isolation and gain root access. Hosting providers are urged to prioritize patching, as a single compromised account could expose neighboring tenants or the entire server.

Acronis Patches High-Severity Privilege Escalation Flaw in cPanel & Plesk Backup Tools Acronis has released security updates to address a high-severity local privilege-escalation vulnerability (CVE-2026-87886) in its Backup plugin for cPanel & WHM and Backup extension for Plesk. The flaw, rated 7.8 on the CVSS scale, stems from insecure file permissions in Linux-based Acronis backup components, classified as CWE-276 (incorrect default permissions). Exploitation requires local access with low-level privileges but no user interaction. Successful attacks could allow threat actors to escalate privileges, compromising system confidentiality, integrity, and availability. Attackers with initial access via compromised accounts, weak credentials, or vulnerable web applications could leverage the flaw to access backup data, system files, or other customer accounts on shared hosting infrastructure. Acronis confirmed limited, targeted exploitation in the wild but warned that public disclosure and patch availability may increase attack risks. The vulnerability was patched in: - Acronis Backup plugin for cPanel & WHM (version 1.9.3 HF3) - Acronis Backup extension for Plesk (version 1.8.11) Managed service providers and hosting companies are urged to prioritize updates, as cPanel and Plesk servers often host multiple customer workloads. Security teams should monitor for unauthorized local access, unexpected privilege changes, and suspicious activity in Acronis-related files or directories. For organizations unable to patch immediately, Acronis recommends restricting local access, limiting shell permissions, and isolating backup infrastructure from standard hosting environments. The vendor’s advisory confirms the fix addresses one high-severity flaw, with exploitation already detected.

Critical SQL Injection Flaw in cPanel’s EmailTrack Grants Root Access (CVE-2026-67401) On September 8, 2026, cPanel disclosed CVE-2026-67401, a critical SQL injection vulnerability in its EmailTrack feature, which could allow authenticated attackers to gain root-level control of vulnerable servers. The flaw affects all supported cPanel/WHM versions prior to patched releases, including 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4, and 11.138.1.9. Exploitation requires a valid cPanel account with mail-related privileges, limiting the attack surface to authenticated users rather than unauthenticated internet-wide threats. However, the impact remains severe, particularly for shared-hosting providers, managed servers, and multi-tenant environments, where a single compromised account could endanger other customers on the same server. The vulnerability stems from an SQL injection flaw in EmailTrack, a tool that monitors email delivery activity. Attackers can abuse this weakness to create arbitrary files on the server, enabling them to place malicious content in sensitive locations. Successful exploitation grants root access, providing full control over the system including hosted websites, databases, email accounts, backups, configuration files, and stored credentials. With root privileges, attackers could: - Deploy malware or persistence mechanisms - Alter website content or steal customer data - Disable security tools - Use the compromised server as a launchpad for further attacks Security researcher Ali Mustafa (nd abe1526) reported the flaw. cPanel has released patches for affected versions, and administrators are urged to upgrade immediately. While restricting public access is insufficient (since exploitation requires authenticated access), security teams should also: - Review cPanel accounts with email-related permissions and remove unnecessary privileges - Enforce multi-factor authentication (MFA) for exposed accounts - Monitor for suspicious files, unexpected changes, or unusual root-level processes - Analyze logs for signs of exploitation attempts The vulnerability underscores the risks of privilege escalation in multi-user hosting environments, where a single compromised account can lead to a full server takeover.

Critical cPanel Vulnerability (CVE-2026-65643) Grants Root Access via Low-Privilege Accounts A severe vulnerability in cPanel and WHM, the widely used web hosting control panel software, has been disclosed, allowing authenticated users with low privileges to gain root-level control of entire servers. Tracked as CVE-2026-65643, the flaw was detailed in an advisory published on August 27, 2026, by cPanel support engineer Devon Courtney. The vulnerability resides in cPanel’s domain parking functionality, a common feature enabling users to point additional domains to an existing website. Exploitation requires only a legitimate cPanel account with permission to add parked or addon domains, making it accessible to attackers via cheap shared hosting plans or compromised accounts. The flaw allows arbitrary file creation anywhere on the server, leading to remote code execution (RCE) as root effectively granting full control over the system. On shared hosting environments, this poses a catastrophic risk: a single compromised account could expose all websites, databases, and email accounts on the same server. Hosting providers face the threat of mass defacement, data theft, malware deployment, or lateral movement across their infrastructure. The vulnerability affects all supported cPanel and WHM versions, with patches released for: - 11.110.0.141 or later - 11.134.0.53 or later - 11.136.0.37 or later - 11.138.0.2 or later - WP2 build 11.138.1.7 or later Servers running end-of-life (EOL) versions remain unpatched unless upgraded to a supported release. While cPanel typically deploys automatic updates, administrators with manual policies must verify their build numbers and apply fixes immediately. Hosting providers are also advised to review and restrict domain-parking permissions on unpatched servers to mitigate risk. Given cPanel’s dominance in shared and reseller hosting, rapid exploitation attempts are expected, making urgent patching the primary defense.

Critical Privilege-Escalation Flaw in cPanel & WHM Exposes Servers to Root-Level Compromise A severe vulnerability in cPanel & WHM (CVE-2026-58048) has been disclosed, allowing authenticated users to execute arbitrary SQL commands with full database administrative privileges. The flaw, which affects the platform’s database management functionality, could lead to root-level server compromise in certain configurations, particularly in shared hosting environments. ### Key Details - Who: The vulnerability impacts all supported versions of cPanel & WHM prior to patched releases. - What: An authenticated attacker with access to the MySQL or MariaDB feature can escalate privileges, bypassing assigned permissions to execute administrative SQL commands. - Impact: Successful exploitation could enable attackers to: - Access or exfiltrate sensitive customer databases. - Modify database users and permissions. - Extract credentials or deploy malicious triggers. - Gain filesystem access, potentially leading to full server compromise. - Where: The risk is highest in shared hosting environments, where multiple users share the same server. - When: The flaw was disclosed by WebPros, with credit to security researcher Vincent55 Yang. No technical exploitation details have been publicly released. ### Mitigation & Patching cPanel has released patched versions to address the issue: - 11.110.0.137 - 11.118.0.71 - 11.126.0.78 - 11.134.0.48 - 11.136.0.32 - 138.1.6 (for WP2 deployments) For administrators unable to patch immediately, a temporary mitigation involves revoking the MySQL feature from affected cPanel users via feature list management. Security teams are advised to review database audit logs for suspicious activity, such as unauthorized privilege assignments or unusual file-related operations. Hosting providers should prioritize patching, as the severity of the flaw makes rapid remediation critical.

Large-Scale Cyber Campaign Hijacks GitHub Actions to Target Web Hosting Servers A sophisticated cyber campaign is exploiting GitHub Actions to weaponize trusted open-source projects, turning them into tools for scanning and compromising web hosting servers. The attack, uncovered by analysts at Socket.dev, abuses free GitHub compute resources to target cPanel and WHM servers critical infrastructure for managing websites, email accounts, and databases. Between July 12 and 13, 2026, attackers compromised a legitimate PHP developer’s Packagist account, injecting malicious GitHub Actions workflow files into ten development versions of their packages. These workflows, containing 55–62 malicious files each, launch temporary Ubuntu runners that download Linux payloads and scan the internet for vulnerable hosts. The campaign extends beyond the initial compromise, with thousands of matching workflow files discovered across unrelated repositories, indicating a broad effort to hijack automation pipelines. The attack chain begins when a compromised repository triggers a workflow, spinning up an ephemeral GitHub runner. The runner fetches a processor-specific payload from a threat actor-controlled server (43.228.157.68) and exploits CVE-2026-41940, an authentication bypass flaw in cPanel and WHM. Successful breaches expose cloud credentials, payment data, and source control tokens including AWS keys, GitHub/GitLab tokens, OpenAI/Google API keys, Stripe credentials, and SSH material. The malware exfiltrates stolen data in small chunks via HTTP POST requests, with heartbeats sent every 30 seconds. While installing the affected PHP packages does not directly execute the malware, root-level GitHub Actions in compromised repositories serve as the attack engine. A single WHM compromise can jeopardize multiple customer accounts, databases, and application secrets. The campaign remains active despite the suspension of one GitHub account, underscoring its persistence. Indicators of compromise include the C2 server IP (43.228.157.68), payload delivery URLs, and the compromised maintainer account (dinushchathurya). Affected Packagist packages span multiple repositories, all tied to the same developer. Defensive measures include disabling suspicious workflows, rotating credentials, and patching cPanel/WHM systems. The incident highlights the risks of untrusted automation in CI/CD pipelines, echoing past supply chain attacks where stolen credentials enabled further breaches.

cPanel Patches Critical Authentication Vulnerability Affecting Control Panel Access cPanel has released urgent security updates to fix a critical vulnerability in its control panel software that could allow attackers to gain unauthorized access through authentication flaws. The issue impacts all currently supported versions, with patches now available in the following releases: - 11.110.0.97 - 11.118.0.63 - 11.126.0.54 - 11.132.0.29 - 11.136.0.5 - 11.134.0.20 cPanel warned that unsupported versions may also be vulnerable, urging users to update immediately. While the company did not disclose technical details, web hosting provider Namecheap revealed the flaw involves an authentication exploit targeting login mechanisms. As a precaution, Namecheap temporarily blocked access to TCP ports 2083 and 2087, disrupting customer access to cPanel and WHM interfaces until the patch was deployed. The company confirmed that fixes were applied to Reseller and Stellar Business servers by April 29, 2026, at 02:42 a.m. UTC, with remaining systems updated shortly after. No active exploitation has been reported.

Cybersecurity Roundup: Key Incidents and Developments from April 2026 Last week saw a surge in cybersecurity threats, regulatory actions, and technological advancements highlighting both emerging risks and evolving defenses. Here’s a breakdown of the most critical developments: ### AI and Automation: New Frontiers for Cybercrime and Defense - AI-Powered Cybercrime: Threat actors are leveraging gig platforms like RentAHuman to hire AI agents for tasks such as physical surveillance, item delivery, and in-person meetings, blurring the line between digital and real-world attacks. - AI Supply Chain Risks: Cisco released an open-source toolkit to verify AI model lineage, addressing concerns that enterprises lack visibility into modifications made to downloaded models from repositories like Hugging Face. - AI-Driven Attacks: OpenAI warned that attackers are scaling operations using AI, while Anthropic adopted a more restrictive approach to advanced AI access. Meanwhile, automated LLM red teaming tools are evolving, with Capital One proposing Adaptive Instruction Composition to prioritize high-impact attack vectors. - AI Traffic Surge: AI workflows are generating larger, less predictable data flows, with Backblaze reporting a shift toward high-bandwidth traffic between fewer endpoints. ### Data Breaches and Privacy Violations - Massive Fines: U.S. state privacy regulators imposed $3.425 billion in fines in 2025 nearly double the 2024 total reflecting stricter enforcement trends. - High-Profile Breaches: - ADT confirmed a breach on April 20, exposing customer data after hackers accessed its systems. - Udemy suffered a breach claimed by ShinyHunters, leaking 1.4 million records with sensitive user details. - UK Biobank: Medical data from 500,000 British volunteers was listed for sale on Alibaba, raising concerns about genetic and clinical data misuse. - Academic Data Leaks: A study of 2.7 million arXiv submissions found that 88% of LaTeX source files contained unintended public disclosures, including drafts, comments, and project data. ### Critical Vulnerabilities and Exploits - Windows Zero-Day (CVE-2026-32202): Actively exploited in the wild, this Windows Shell spoofing flaw allows attackers to force authentication to malicious servers. It stems from an incomplete patch for a prior vulnerability (CVE-2026-21510) linked to APT28 (Fancy Bear). - Linux Kernel Flaw (CVE-2026-31431): A nine-year-old privilege escalation bug ("Copy Fail") affects nearly all major Linux distributions since 2017, with a public proof-of-concept exploit available. - GitHub Enterprise Server RCE (CVE-2026-3854): While patched on GitHub.com, 88% of self-hosted instances remain vulnerable to remote code execution. - cPanel Zero-Day (CVE-2026-41940): Exploited since February 2026, this authentication bypass flaw in the web hosting control panel highlights delayed patching risks. - Vect Ransomware Bug: A flaw in the Vect ransomware-as-a-service (RaaS) effectively turns it into a data wiper, with affiliates encrypting files irreversibly. ### Threat Actor Activity - UNC6692: A new threat group impersonated IT helpdesk staff via Microsoft Teams, tricking employees into downloading malware disguised as a "Mailbox Repair Utility" in a campaign active since December 2025. - Robinhood Phishing: Cybercriminals hijacked Robinhood’s email systems to send phishing emails to users, with reports surfacing on April 26. - Black Axe Arrests: Swiss police arrested 10 suspected members of the Black Axe cybercrime gang, including its Southern Europe "Regional Head," in a coordinated raid on April 28. - Roblox Account Theft: Ukrainian police detained three suspects accused of stealing and reselling 600,000 Roblox accounts via malware disguised as game tools. - SMS Blaster Operation: Canadian authorities arrested three men for operating a mobile cell tower spoofing device, used to send fraudulent SMS messages across the Greater Toronto Area. ### Regulatory and Law Enforcement Actions - Chinese Hacker Extradited: Xu Zewei, a Chinese national, was extradited from Italy to the U.S. for allegedly breaching thousands of systems, including those tied to COVID-19 research. - Albanian Call Center Bust: A joint operation dismantled a €50 million fraud ring operating from Albania, with 10 arrests and €900,000 seized. ### Tooling and Infrastructure Updates - IPFire DNS Firewall: The open-source firewall now includes built-in domain blocking, replacing third-party tools like Pi-hole for malware and phishing protection. - Open-Source Privacy Tools: - BleachBit 6.0.0 enhanced secure deletion and browser cleaning for Windows/Linux. - Kiji Privacy Proxy (by Dataiku) masks PII before prompts reach external AI services. - SimpleX Chat released a user-identifier-free encrypted messenger. - Linux Storage: Stratis 3.9.0 added online encryption and cache-less pool startup for improved security. - Proxmox Backup Server 4.2 introduced S3 storage support and parallel sync jobs. ### SOC and Identity Challenges - SOC Metrics Under Scrutiny: The UK’s NCSC warned that ticket-based metrics (e.g., IT service desk KPIs) can undermine security operations by failing to measure real attack detection. - AI and IAM Gaps: Identity and access management (IAM) systems, designed for human users, struggle with AI agents that bypass traditional authentication. The FIDO Alliance is exploring new frameworks for AI-driven payments. - Shadow AI Risks: 31% of employees using AI tools receive no employer training, widening the gap between adoption and governance. ### Industrial and Infrastructure Threats - ICS Blind Spots: Researchers identified three critical gaps in industrial control system (ICS) intrusion detection, complicating plant security. - GPS Spoofing Detection: Oak Ridge National Laboratory developed a portable tool to expose GPS signal manipulation in transit networks. ### Open-Source and Developer Tools - Visual Studio Updates: GitHub Copilot now integrates cloud agents for scalable task execution, while VS Code 1.118 added auto-model selection for Copilot CLI. - Warp Terminal: The AI-centric terminal open-sourced its client under the AGPL license, with OpenAI as a founding sponsor. - LuLu Firewall: A free macOS tool now monitors outbound connections to block unauthorized data exfiltration. ### Emerging Trends - Bad Bots: AI agents now account for 40% of internet traffic, alongside traditional "good" and "bad" bots, per Thales’ 2026 report. - AI Prompt Confidentiality: Researchers raised concerns about unpublished research and proprietary data being leaked via commercial AI tools like Research Rabbit and Elicit AI. - Met Police AI Scrutiny: London’s Metropolitan Police faced backlash for using Palantir’s AI to monitor officers’ movements for misconduct investigations. This wave of incidents underscores the accelerating convergence of AI, automation, and cyber threats while also highlighting the urgent need for adaptive defenses, stricter data governance, and proactive vulnerability management.

Reborn Gaming Suffers Data Breach Exposing 126 Email Addresses Last week, gaming platform Reborn Gaming experienced a data breach affecting 126 unique email addresses, along with associated IP addresses and Steam IDs. The incident stemmed from a vulnerability in cPanel/WHM, a widely used web hosting control panel. According to breach notification platform Have I Been Pwned, 68% of the exposed email addresses were already linked to LinkedIn profiles, increasing the risk of targeted phishing or credential-stuffing attacks. The breach highlights ongoing security risks tied to misconfigured or unpatched hosting infrastructure, particularly in gaming and online communities where user data is frequently targeted. No further details on the timeline of the attack or remediation efforts have been disclosed. The incident serves as a reminder of the persistent threats posed by unsecured third-party services in digital ecosystems.

Critical cPanel Flaw Exploited in Widespread "Sorry" Ransomware Attacks A critical authentication bypass vulnerability in cPanel and WHM (CVE-2026-41940) is being actively exploited to deploy the "Sorry" ransomware, targeting Linux-based web hosting servers. The flaw, patched in an emergency update this week, allows attackers to gain unauthorized access to control panels managing websites, databases, and webmail. Exploitation attempts date back to late February, with attacks escalating rapidly after the vulnerability was disclosed. Security firm Shadowserver reports that at least 44,000 IP addresses running cPanel have been compromised. Threat actors began mass-exploiting the flaw on Thursday, deploying a Go-based Linux encryptor that appends the ".sorry" extension to encrypted files. The ransomware uses ChaCha20 encryption, with keys secured via an embedded RSA-2048 public key, making decryption impossible without the attacker’s private key. Victims receive a ransom note (README.md) directing them to contact the threat actor via Tox (ID: 3D7889AEC00F2325E1A3FBC0ACA4E521670497F11E47FDE13EADE8FED3144B5EB56D6B198724). Hundreds of compromised sites have already been indexed by Google, indicating widespread impact. This campaign is unrelated to a 2018 ransomware operation that also used the ".sorry" extension. Security experts warn that exploitation is expected to intensify in the coming days.