Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

Summary

A critical cPanel flaw (CVE-2026-65643) allows root code execution via domain parking/addon functionality. Patches are available for supported versions. Exploitation in the wild is unconfirmed, but CISA lists other cPanel plugin vulnerabilities.

Key Takeaways

1. cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user.
2. The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported versions of cPanel & WHM.
3. Successful exploitation leads to code execution as the root user, giving an attacker full control of the server.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents technical details about a security vulnerability, including a CVE identifier and specific version numbers for patches. It cites cPanel's own advisories and cross-references with CISA's catalog, indicating a reliance on official and authoritative sources.

Bias assessment: Technical Reporting. The article focuses on the technical aspects of a security vulnerability and its remediation. It avoids sensationalism and presents information factually, with a neutral tone. The primary goal is to inform about a technical issue and its solution.

Note: This article details a critical security vulnerability. Always verify patch status and consult official cPanel documentation for the most up-to-date information on mitigation and exploitation.

Credibility flag: Technical, Verify Patches

Claimed Facts (7)

• This is a direct statement of fact regarding the release of patches for a specific vulnerability.
• This states a verifiable fact about the CVE identifier and the versions of cPanel & WHM affected.
• This reports cPanel's official description of the vulnerability and its immediate consequence.
• This provides specific, verifiable version numbers for the released patches.
• This states a fact about the automatic update process for servers configured to receive them.
• This is a factual statement about a verification process and its outcome.
• This reports a factual event: CISA's addition of a specific CVE to its catalog with details about its nature.

Opinions (5)

• While presented as fact, the phrase 'could allow' introduces a degree of potentiality rather than absolute certainty of exploitation, leaning towards an informed opinion on the risk.
• The absence of a CVSS score is an observation, and the confirmation of no record is a factual finding, but the implication of this absence can be seen as an interpretation or opinion on the severity assessment.
• This statement reports a lack of information from cPanel and CISA, which, while factual, can imply an opinion about the current threat landscape or the completeness of public information.
• This is a direct quote expressing an opinion on the limitations of patching, highlighting a potential ongoing risk.
• This is a direct quote stating an observation and experience, which is a form of opinion based on their findings.

Claims (5)

• The phrasing 'could allow' introduces a speculative element, as exploitation is not confirmed, making the direct impact an unsubstantiated claim without further evidence of successful attacks.
• This statement asserts a lack of information, which, while potentially true, could be an oversimplification or an opinion on the adequacy of cPanel's advisory without exhaustive verification.
• This claim, while presented as a fact from cPanel, could be considered dubious without independent verification of its scope and the exact conditions under which it applies, especially given the criticality of the flaw.
• The uncertainty about the support status of specific branches, presented as a lack of information from cPanel, could be interpreted as a subtle implication of potential oversight or incomplete disclosure, bordering on a dubious claim about the company's transparency.
• This observation, while factual, could be interpreted as a subtle insinuation of an omission or a potential issue with DNSOnly without direct evidence, making it a potentially dubious claim based on what is *not* said.

Key Sources

• cPanel — Software Company
• The Hacker News — Cybersecurity News Outlet
• CISA — U.S. Cybersecurity and Infrastructure Security Agency
• Plesk — Web Hosting Control Panel
• Phusion — Software Development Company (Passenger)