A critical vulnerability disclosed on August 27, 2026 is putting cPanel & WHM administrators on alert. Tracked as CVE-2026-65643, the flaw was detailed by cPanel security engineer Devon Courtney and allows a low-privilege, authenticated hosting account to escalate straight to root-level control of the server.
The bug lives in domain parking — a routine feature that lets customers point an extra domain at an existing website. Any account with permission to add parked or addon domains can create arbitrary files outside its own sandboxed home directory, and that file-write capability chains directly into code execution as root.
What makes this notable for devs and sysadmins alike: no chained exploit, phishing, or malware required. Just a legitimate, low-cost shared hosting login, whether purchased or obtained through a compromised account. On multi-tenant shared hosting, that's enough for one bad actor to threaten every other site, database, and mailbox on the box.
Patches are available across all currently supported cPanel/WHM release branches. If you manage cPanel infrastructure:
- Patch immediately to the latest supported build
- Restrict domain-parking/addon-domain permissions where not needed
- Restart cpsrvd after updating
- Audit and migrate off any EOL branches
- Watch CISA's KEV catalog — not yet listed, but worth monitoring
Full technical breakdown, detection log queries, and a SOC prevention checklist via Xpert4Cyber 🔗 https://www.xpert4cyber.com/2026/08/cpanel-zero-day-root-control-vulnerability.html
Top comments (0)