Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
Summary: cPanel released patches for CVE-2026-65643, a critical flaw in domain parking and addon domain functionality in cPanel and WHM that affects all supported versions and lets an authenticated account holder who can add parked or addon domains create arbitrary files on the server. cPanel said successful exploitation leads to code execution as the root user, giving an attacker full control of the server, and the August 27 notification carries no CVSS score, no interim mitigation, and no way to verify whether a server has already been compromised.
Key Takeaway: On shared hosting, the attacker who reaches root this way is a single authenticated customer with permission to add parked or addon domains, and the advisory offers no way to tell whether that has already happened on your servers.