{"id":10602,"date":"2026-08-31T08:00:55","date_gmt":"2026-08-31T12:00:55","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10602"},"modified":"2026-08-30T07:17:17","modified_gmt":"2026-08-30T11:17:17","slug":"cpanel-fixes-critical-flaw-offers-no-compromise-check","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/","title":{"rendered":"cPanel fixes critical flaw, offers no compromise check"},"content":{"rendered":"<p dir=\"ltr\"><a href=\"https:\/\/www.cpanel.net\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">cPanel<\/a> released patches on August 27 for a critical flaw that could let an authenticated account holder gain full root access to a server, but the advisory stops short of telling administrators how to check whether an attacker already got in.<\/p>\n<p dir=\"ltr\">The vulnerability, which carries the identifier <a href=\"https:\/\/support.cpanel.net\/hc\/en-us\/articles\/42959571221527-Security-CVE-2026-65643-Vulnerability-in-cPanel-s-Domain-Parking-Functionality-August-27-2026\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">CVE-2026-65643<\/a>, sits in how cPanel and WHM handle domain parking and addon domains. According to cPanel, any account holder with permission to add parked or addon domains can create arbitrary files on the server, and from there, exploitation leads directly to code execution as root, giving an attacker full control of the machine.<\/p>\n<p dir=\"ltr\">The fix covers versions 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, and 11.138.1.7 for WP Squared. Notably, the advisory doesn&#8217;t mention DNSOnly, and it leaves open whether older branches, specifically 11.118 and 11.126, which cPanel patched separately back in July, still receive support. Servers set to update automatically will get the fix without administrators needing to do anything. Everyone else can force it manually by running \/scripts\/upcp &#8211;force as root, or through WHM&#8217;s upgrade panel.<\/p>\n<p dir=\"ltr\">What the notification doesn&#8217;t include matters just as much as what it does. It carries no CVSS score, and as of August 28, the CVE Program&#8217;s official record store still hadn&#8217;t published an entry for CVE-2026-65643, even though it already listed two other cPanel flaws from July. <a href=\"https:\/\/hostingdiscussion.com\/news\/cpanel-patches-a-bug-that-let-regular-hosting-users-act-as-database-root\/\">cPanel<\/a> also hasn&#8217;t said whether anyone has exploited this vulnerability, and CISA&#8217;s Known Exploited Vulnerabilities catalog doesn&#8217;t include it, at least for now.<\/p>\n<p dir=\"ltr\">That gap matters given cPanel&#8217;s own track record. In a separate advisory from earlier in August covering a Phusion Passenger flaw, the company included a command administrators could run to check Apache error logs for signs of prior exploitation. Plesk, which WebPros develops alongside cPanel, went further, publishing a five-item checklist for spotting compromise. No equivalent guidance accompanies this latest patch.<\/p>\n<p dir=\"ltr\">Administrators now have a fix. Whether they needed one sooner is a question the advisory leaves unanswered.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>cPanel released patches on August 27 for a critical flaw that could let an authenticated account holder gain full root access to a server, but the advisory stops short of telling administrators how to check whether an attacker already got in. The vulnerability, which carries the identifier CVE-2026-65643, sits in how cPanel and WHM handle [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71],"tags":[6830,7896,7899,7898,7897],"class_list":["post-10602","post","type-post","status-publish","format-standard","hentry","category-featured","tag-cpanel-security","tag-cve-2026-65643","tag-domain-parking-exploit","tag-hosting-server-security-patch","tag-whm-root-access"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>cPanel fixes critical flaw, offers no compromise check - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"cPanel fixes critical flaw, offers no compromise check - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"cPanel released patches on August 27 for a critical flaw that could let an authenticated account holder gain full root access to a server, but the advisory stops short of telling administrators how to check whether an attacker already got in. The vulnerability, which carries the identifier CVE-2026-65643, sits in how cPanel and WHM handle [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-31T12:00:55+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-30T11:17:17+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/\",\"name\":\"cPanel fixes critical flaw, offers no compromise check - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-08-31T12:00:55+00:00\",\"dateModified\":\"2026-08-30T11:17:17+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"cPanel fixes critical flaw, offers no compromise check\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"cPanel fixes critical flaw, offers no compromise check - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/","og_locale":"en_US","og_type":"article","og_title":"cPanel fixes critical flaw, offers no compromise check - Web Hosting News","og_description":"cPanel released patches on August 27 for a critical flaw that could let an authenticated account holder gain full root access to a server, but the advisory stops short of telling administrators how to check whether an attacker already got in. The vulnerability, which carries the identifier CVE-2026-65643, sits in how cPanel and WHM handle [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/","og_site_name":"Web Hosting News","article_published_time":"2026-08-31T12:00:55+00:00","article_modified_time":"2026-08-30T11:17:17+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/","url":"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/","name":"cPanel fixes critical flaw, offers no compromise check - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-08-31T12:00:55+00:00","dateModified":"2026-08-30T11:17:17+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/cpanel-fixes-critical-flaw-offers-no-compromise-check\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"cPanel fixes critical flaw, offers no compromise check"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":121,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10602","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10602"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10602\/revisions"}],"predecessor-version":[{"id":10603,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10602\/revisions\/10603"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10602"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10602"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10602"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}