- The Mess: cPanel patched CVE-2026-65643, a critical flaw in domain parking and addon-domain functionality that lets an authenticated hosting account create arbitrary files and ultimately execute code as root. The bug affects all supported cPanel & WHM versions.
- The Damage: On a shared hosting server, one compromised or malicious customer account can potentially escape its intended boundaries and take control of the entire host — including other customers’ websites and data.
- The Fix: Update cPanel immediately to 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2 or later, depending on the installed branch.
Shared hosting depends on one simple assumption:
Customer A cannot become root over Customer B.
CVE-2026-65643 attacks that assumption.
The vulnerability sits inside cPanel’s domain parking and addon-domain functionality.
And the final destination is not another account.
It’s root.
The Account Starts With Limited Power
The attacker needs an authenticated cPanel account with permission to add parked or addon domains.
That sounds like a significant limitation.
On a shared hosting server, it isn’t.
Thousands of customers may have exactly that level of access.
The vulnerability allows the account holder to create arbitrary files on the server.
From there, exploitation can lead to code execution with root privileges.
The isolation boundary is gone.
Shared Hosting Is Where This Gets Ugly
Imagine a server hosting 200 websites.
Each customer gets their own account.
Each customer is supposed to be restricted to their own files.
The attacker only needs one account.
If CVE-2026-65643 is successfully exploited, the attacker can potentially move from:
one hosting account → root → entire server
That changes the incident completely.
The target isn’t one website anymore.
It’s the machine hosting all of them.
The Vulnerability Is Surprisingly Quiet
cPanel disclosed the issue on August 27 and released patched builds immediately.
There is no official CVSS score in the vendor notification.
There is also no statement from cPanel confirming exploitation in the wild.
That means we shouldn’t call this an active zero-day.
But there is already an interesting warning sign.
A cPanel customer reported an incident in which a compromised account was followed by identical 1337.txt files appearing across unrelated accounts, followed by root-level WHM/API activity. The customer suspects the newly disclosed vulnerability was the attack mechanism, although that has not been independently confirmed.
That’s exactly the kind of event administrators should investigate.
Patch Versions Matter
cPanel released fixes for the supported branches:
- 11.110.0.141+
- 11.134.0.53+
- 11.136.0.37+
- 11.138.0.2+
- 11.138.1.7+ for WP Squared
Servers using automatic daily updates should receive the fix automatically.
Administrators can also force the update with:
/scripts/upcp --force
cPanel recommends upgrading end-of-life installations to a supported branch before applying the security update.
Patching Doesn’t Undo a Root Compromise
This is the part administrators shouldn’t ignore.
A patch closes the vulnerability.
It doesn’t remove:
- malicious files
- new SSH keys
- rogue administrator accounts
- modified PHP files
- scheduled tasks
- web shells
- persistence mechanisms
- stolen credentials
If the server was exposed while vulnerable, patching should be followed by forensic review.
Especially on shared hosting.
One compromised account can be the beginning of a much larger incident.
The Real Security Boundary Was the Customer Account
cPanel exists to enforce separation.
Customer A gets Customer A’s files.
Customer B gets Customer B’s files.
Root stays with the administrator.
CVE-2026-65643 attacks the last part of that model.
Once root is obtained, the account separation that makes shared hosting possible becomes irrelevant.
The attacker owns the host.
And everyone renting space on it becomes part of the incident.
Bugstoday Opinion
This is exactly why hosting control panels deserve more attention than they usually get.
A vulnerability in a normal website might compromise one application.
A vulnerability in the software controlling hundreds of websites can compromise the server behind all of them.
CVE-2026-65643 doesn’t need a dramatic ransomware campaign to be dangerous.
Give an attacker one valid hosting account.
Give them a vulnerable cPanel server.
The rest can potentially follow.
Bugstoday verdict: shared hosting only works when customers stay separated. If one account can climb to root, the word “shared” suddenly means something very different. Patch cPanel now — then check whether root was already there.
Today’s Bugs. Tomorrow’s Breaches.
