Critical cPanel Bug Lets a Single Hosting Customer Seize an Entire Server

Key points

• CPanel has patched a critical flaw, tracked as CVE-2026-65643, in its hosting control panel used by millions of websites.
• The bug sits in the domain parking and addon domain features of cPanel and WebHost Manager, known as WHM.
• A logged-in hosting customer could exploit the flaw to run commands as root, the top-level administrator account on a Linux server.
• All supported versions of cPanel and WHM are affected, and the vendor is urging server operators to update immediately.
• No public reports of exploitation have surfaced yet, but hosting providers are the intended fix path for end users.

CPanel, the software that most shared web hosting companies use to let customers manage their sites, has pushed out an emergency fix for a serious security bug. The company rates it critical. It affects every supported version of the product.

The issue is tracked as CVE-2026-65643. It lives in the parts of cPanel and WHM that handle domain parking, where a customer points an extra web address at their account, and addon domains, where a customer runs a second website from the same hosting plan. It's the second time this year cPanel has shipped an emergency patch for a root-level bug: we covered a database privilege flaw, CVE-2026-58048, on 4 August.

On a shared hosting server, customers sit side by side, each meant to be sealed off from the others. This bug breaks that seal.

What can an attacker actually do?

An attacker with a normal cPanel account on a vulnerable server can run commands as root, the all-powerful administrator account on a Linux system. Root access means total control: reading every customer's files or installing backdoors. One paying customer, or anyone who steals a customer's login, could take over the whole server and every site on it. On a busy shared host that can mean thousands of websites at once.

CPanel has not published full technical details, which is standard practice while operators race to patch.

Who is affected?

All supported versions of cPanel and WHM are affected. That covers the vast majority of hosting providers reselling shared Linux hosting, from small regional companies to large global brands.

If you run a website through a hosting company, you almost certainly don't patch this yourself. Your hosting provider does. Check your provider's status page or support channel and confirm they've applied the update.

How did this happen?

Control panels like cPanel run parts of their code with elevated privileges so they can create accounts, edit web server settings, and manage mail. When a privileged helper accepts input from a regular user without validating it carefully, an attacker can smuggle in commands. That's the pattern behind most root-escalation bugs in hosting software, and it fits the shape of this advisory.

CPanel has issued fixed builds through its normal update channels. Servers set to auto-update should pick them up. Anyone on manual updates should treat this as urgent.

What should ordinary site owners do?

Ask your hosting provider, in writing if you can, whether they've patched CVE-2026-65643. Change your cPanel password after they confirm the fix, in case an attacker already grabbed credentials. Turn on two-factor authentication if your host offers it.

Watch your site for unexpected changes over the coming weeks: new admin users, unfamiliar files in the web root, or outbound emails you didn't send. Those are the usual fingerprints of a compromised shared host.

The pattern here is worth flagging plainly: cPanel's privileged architecture makes it a high-value target, and this is the second critical root-escalation bug patched in six weeks. Hosting providers who haven't moved to auto-updates are carrying risk they can't easily see.