Web hosting administrators must take immediate action, as cPanel has rolled out an emergency security update to address a critical vulnerability.
Disclosed on April 28, 2026, this flaw impacts various authentication paths within the cPanel and WebHost Manager (WHM) ecosystem.
Control panels like cPanel act as the central nervous system for web servers, handling everything from email routing to database management. Threat actors highly prize authentication vulnerabilities in such platforms.
If an attacker successfully bypasses the authentication mechanisms, they could gain administrative privileges.
This level of access allows them to deploy malware, steal sensitive customer data, or launch secondary attacks against other networks using the compromised infrastructure.
Given the severity of the flaw, hosting providers and independent server owners cannot afford to delay patching.
The vulnerability lies deep within the software’s authentication framework, making prompt remediation the only reliable defense against potential intrusions.
The security team at cPanel confirmed that this vulnerability affects all currently supported versions of the software.
To secure their infrastructure, administrators must verify their current build and upgrade to a newly released, secure version. The official patch applies to the following specific software tiers.
Servers running older, unsupported releases are highly likely to be vulnerable to this same flaw.
cPanel explicitly warns that users on unsupported software must work toward upgrading their entire server environment immediately, as no security patches will be issued for legacy builds.
System administrators must force an update to retrieve and install the patched version of cPanel and WHM. You can run this update directly on the server’s command line.
Run the following command as the root user to initiate the patching process.
/scripts/upcp --forceThis command forces the cPanel update script to execute immediately. It ensures the system downloads and applies the latest security patches, overriding standard scheduled update settings.
After the process finishes, administrators should check their WHM interface to confirm the server reflects one of the secured version numbers.
In addition to applying the patch, security teams should actively review their server access logs. Look for any suspicious login attempts, unexpected account creations, or unusual administrative activities that occurred before the patch deployment.
Proactive monitoring helps identify if threat actors attempted to exploit the authentication paths before the system was secured.
Finally, administrators should strengthen their overall security posture by enforcing multi-factor authentication (MFA) and restricting WHM access to trusted IP addresses.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…