cPanel CVE-2026-65643: a neighbor account can get root

cPanel notified customers on August 27 of CVE-2026-65643, a flaw in parked and addon domain handling that lets an authenticated account holder write arbitrary files on the server and execute code as root. Not the reseller. Not the admin. Any account on the box with permission to add a domain — which, on shared hosting, is close to all of them. If your small-business site sits on a cPanel host, the neighbor in the next account is now a plausible path to your files.

What actually happened

Per The Hacker News, the advisory went out from cPanel support engineer Devon Courtney and covers all supported versions of cPanel & WHM. The mechanism is unglamorous: domain parking and addon domains let a customer point extra hostnames at an existing site without provisioning a separate account. That code path can be pushed into creating files it should not create, and from arbitrary file creation on a Linux host running privileged automation, root follows.

Fixed builds:

• 11.110.0.141 or later
• 11.134.0.53 or later
• 11.136.0.37 or later
• 11.138.0.2 or later
• 11.138.1.7 or later (WP Squared)

Servers on automatic daily updates pick the patch up on their own. To force it, log in as root and run /scripts/upcp --force, or use WHM under Home > cPanel > Upgrade to Latest Version.

Two caveats worth stating plainly. The customer notification shipped without a CVSS score, and as of August 28 no record had been published in the CVE Program's store — so severity ratings you see quoted are other people's math, not the vendor's. And there is no confirmed in-the-wild exploitation and no CISA KEV listing as of that date. Treat this as urgent because of the blast radius, not because anyone has proven attacks yet.

Why shared hosting is a trust decision, not a price decision

Small businesses land on cPanel hosting because it is cheap and the copier guy's cousin set it up. What you actually bought is a machine where your document root, your database credentials, and your wp-config.php sit on the same kernel as several hundred strangers. The security model holding those apart is the panel software. When the panel software has a privilege-escalation bug, the isolation you were paying for is gone until someone patches — and on shared hosting, someone else does the patching.

That is the real finding here. Everything about this bug's fix is out of your hands. You cannot apply /scripts/upcp --force on a plan where you do not have root. Your only levers are asking and leaving.

What to do this week:

Ask your host, in writing, which build they are running. A host that cannot answer within a business day is telling you something about their patch cadence.

Check for the obvious aftermath yourself. Unexpected files in your document root, cron entries you did not create, modified .htaccess, new admin users in your CMS. Compare against a known-good backup rather than eyeballing it.

Rotate what lived on that box. Database passwords, SMTP credentials, any API key sitting in an application config file. If a root compromise happened, those were readable.

Price out the alternative. If your storefront generates real revenue, a $12/month plan where a stranger's account is your attack surface is a false economy. Isolated hosting — a small VPS, a managed platform, containers you control — costs more per month and removes an entire class of incident where you are not even the target.

Sources: The Hacker News, cPanel release notes.