Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server cPanel关键漏洞可能让单个托管客户获取整个服务器的root控制权

TL;DR

• CVE-2026-65643 is a critical vulnerability in cPanel & WHM affecting all supported versions, allowing authenticated users with parked/addon domain privileges to create arbitrary files on the server and achieve root code execution
• cPanel released patched builds across four branches (11.110.0.141+, 11.134.0.53+, 11.136.0.37+, 11.138.0.2+) and WP Squared (11.138.1.7+), with automatic updates applied to servers configured for daily updates
• No CVSS score has been assigned and no official CVE record exists in the CVE Program store as of August 28, 2026, raising questions about disclosure transparency
• No interim mitigation is provided by cPanel, and the notification offers no method to verify whether a server has already been compromised post-exploitation
• This follows a pattern of critical cPanel vulnerabilities in 2026, including CISA-listed flaws in the LiteSpeed cPanel plugin (CVE-2026-48172, CVE-2026-54420) and an authentication bypass (CVE-2026-41940) linked to ransomware campaigns

Why It Matters

This vulnerability represents a worst-case scenario for shared hosting environments: a single authenticated customer account can escalate to full root control of the entire server, potentially compromising all other tenants. For AI practitioners and infrastructure teams relying on cPanel-hosted services, this underscores the critical importance of timely patching, least-privilege access controls, and proactive compromise detection in multi-tenant hosting architectures.

Technical Details

• Vulnerability mechanism: An authenticated cPanel account holder with permission to manage parked or addon domains can exploit the flaw to write arbitrary files on the server, ultimately achieving code execution as the root user
• Affected scope: All supported versions of cPanel & WHM; the vulnerability does not affect default installations and is limited to servers where affected Passenger packages have been installed
• Patch versions: 11.110.0.141+, 11.134.0.53+, 11.136.0.37+, 11.138.0.2+, and 11.138.1.7+ (WP Squared); servers on end-of-life versions must upgrade to a supported branch to receive the fix
• Update mechanisms: Automatic daily updates apply the patch silently; manual application is available via /scripts/upcp --force as root or through WHM (Home > cPanel > Upgrade to Latest Version), with verification under Server Configuration > Update Preferences
• Related vulnerabilities: Phusion Passenger 6.2.0 (released August 18, 2026) patched a separate Watchdog API flaw exploited in the wild at a shared hosting provider; Plesk released a five-item compromise detection checklist covering indicators such as unexpected entries in /etc/ld.so.preload

Industry Insight

• Hosting providers and managed service operators should treat this as an emergency patching event, prioritizing servers with shared hosting tenants and addon domain functionality; the absence of a CVSS score and CVE record does not diminish the severity and may indicate an attempt to control disclosure timing
• The lack of interim mitigation and compromise verification tools places the burden on administrators to implement their own detection strategies, such as monitoring /etc/ld.so.preload, reviewing Apache error logs, and auditing domain configuration changes
• This incident reinforces the need for defense-in-depth in shared hosting environments: network segmentation, mandatory multi-factor authentication for cPanel access, regular integrity checking, and limiting addon domain permissions to only those users who require them

TL;DR

• cPanel发布紧急安全补丁修复CVE-2026-65643关键漏洞，该漏洞允许认证用户通过域名停放/附加域名功能创建任意文件，可能导致root权限代码执行
• 漏洞影响所有受支持的cPanel & WHM版本，已发布多个分支修复版本（11.110.0.141、11.134.0.53、11.136.0.37、11.138.0.2及WP Squared版本）
• 该漏洞暂无CVSS评分和官方CVE记录，也未列入CISA已知利用漏洞目录，cPanel未提供临时缓解措施或入侵检测方法
• 漏洞利用已在共享主机环境中被发现，Phusion Passenger 6.2.0也发布了相关Watchdog API漏洞修复

为什么值得看

该漏洞可导致共享托管服务器完全沦陷，对托管服务提供商和cPanel用户具有直接威胁。缺乏临时缓解措施和入侵检测手段使得及时补丁成为唯一防护途径。

技术解析

漏洞位于cPanel和WHM的域名停放（domain parking）和附加域名（addon domain）功能，认证账户持有者可利用此创建服务器上的任意文件，成功利用可导致root权限代码执行。受影响版本覆盖所有受支持的cPanel & WHM版本，修复版本包括11.110.0.141、11.134.0.53、11.136.0.37、11.138.0.2及11.138.1.7（WP Squared）。补丁可通过/scripts/upcp --force命令或WHM界面（Home > cPanel > Upgrade to Latest Version）安装，自动更新服务器会自动获取修复。值得注意的是，该漏洞暂无CVSS评分，CVE-2026-65643记录尚未发布，也未列入CISA KEV目录。

行业启示

托管服务提供商应立即检查cPanel版本并强制更新，特别是未启用自动更新的服务器。由于缺乏临时缓解措施和入侵检测手段，延迟更新将显著增加被攻击风险。建议同时关注相关组件（如Phusion Passenger）的安全状态，并参考Plesk提供的五步检查清单排查潜在入侵痕迹。