Critical cPanel Bug Lets a Single Hosting Customer Seize an Entire Server
A flaw in domain parking, tracked as CVE-2026-65643, could hand root control of a shared hosting server to any customer with an account on it.
Key points
- cPanel has patched a critical flaw, tracked as CVE-2026-65643, in its hosting control panel used by millions of websites.
- The bug sits in the domain parking and addon domain features of cPanel and WebHost Manager, known as WHM.
- A logged-in hosting customer could exploit the flaw to run commands as root, the top-level administrator account on a Linux server.
- All supported versions of cPanel and WHM are affected, and the vendor is urging server operators to update immediately.
- No public reports of exploitation have surfaced yet, but hosting providers are the intended fix path for end users.
cPanel, the software that most shared web hosting companies use to let customers manage their sites, has pushed out an emergency fix for a serious security bug. The company rates the flaw critical. It affects every supported version of the product.
The issue is tracked as CVE-2026-65643. It lives in the parts of cPanel and WHM that handle domain parking, where a customer points an extra web address at their account, and addon domains, where a customer runs a second website from the same hosting plan.
On a shared hosting server, dozens or hundreds of customers sit side by side. Each is meant to be sealed off from the others. This bug breaks that seal.
What can an attacker actually do?
An attacker with a normal cPanel account on a vulnerable server can run commands as root, the all-powerful administrator account on a Linux system. Root access means total control: reading every customer's files, changing any website, installing backdoors, or wiping the machine.
In plain terms, one paying customer, or anyone who steals a customer's login, could take over the whole server and every other site on it. On a busy shared host that can mean thousands of websites in one go.
The report from The Hacker News notes that cPanel has not published full technical details, which is standard practice while operators race to patch.
Who is affected?
All supported versions of cPanel and WHM are affected. That covers the vast majority of hosting providers that resell shared Linux hosting, from small regional companies to large global brands.
If you personally run a website through a hosting company, you almost certainly do not patch this yourself. Your hosting provider does. The sensible step is to check your provider's status page or support channel and confirm they have applied the update.
| Detail | Value |
|---|---|
| CVE ID | CVE-2026-65643 |
| Affected software | cPanel and WHM, all supported versions |
| Vulnerable feature | Domain parking and addon domains |
| Severity | Critical, per vendor |
| Impact | Code execution as root |
How did this happen?
Control panels like cPanel run parts of their code with high privileges so they can create accounts, edit web server settings, and manage mail. When one of those privileged helpers accepts input from a regular user without checking it carefully, an attacker can smuggle in commands. That is the pattern behind most root-escalation bugs in hosting software, and it fits the shape of this advisory.
cPanel has issued fixed builds through its normal update channels. Servers set to auto-update should pick them up. Anyone running manual updates should treat this as urgent.
What should ordinary site owners do?
Ask your hosting provider, in writing if you can, whether they have patched CVE-2026-65643. Change your cPanel password after they confirm the fix, in case an attacker already grabbed credentials. Turn on two-factor authentication on your cPanel login if your host offers it.
Watch your site for unexpected changes over the next few weeks: new admin users, unfamiliar files in the web root, or outbound emails you did not send. Those are the usual fingerprints of a compromised shared host.
