ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “plesk”

10 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 10Vulnerability 8Malware 4Data breach 4Ransomware 3Advisory 2Threat actor 2Phishing & fraud 1AI tools & infra 1
SeverityAllcritical 9high 15medium 10low 0info 1

Plesk Backup Manager Flaw Lets Low-Privileged Users Gain Root Access to Servers

CVE-2026-68488 in Plesk Backup Manager lets low-privileged subscription users exploit a symlink race during restores to gain root on Linux servers.

CVE-2026-68488 is a symlink race condition in Plesk Obsidian for Linux Backup Manager during subscription-content restore operations, allowing a user with Panel and FTP access to change ownership of files outside their subscription and escalate to full root access. Affected versions are Plesk for Linux 18.0.80.6 and earlier and 18.0.79.10 and earlier; Plesk for Windows is not affected. Patches are available in 18.0.80.7 and 18.0.79.11 or later. The flaw requires valid subscription access, so it is not unauthenticated remote code execution, but successful exploitation yields complete server compromise, especially dangerous in shared-hosting and multi-tenant deployments.

Cyber Security News · 3d agoVulnerabilityCVE-2026-68488

Acronis Patches Exploited Vulnerability in cPanel Backup Plugin

Acronis urgently patched CVE-2026-87886 (CVSS 7.8), insecure file permissions enabling privilege escalation, exploited in targeted attacks on cPanel & WHM backups.

Acronis released urgent patches for CVE-2026-87886 (CVSS 7.8), insecure file permissions in the Backup plugin for cPanel & WHM and the Backup extension for Plesk that allow attackers to gain elevated privileges. Exploitation has been detected in the wild in limited, targeted attacks against the cPanel & WHM plugin, but not against the Plesk extension. All Linux versions of the plugin before build 1.9.3.1021 and the Plesk extension before build 1.8.11.638 are affected; Acronis urges immediate updates and has not shared technical details.

SecurityWeekupdated · 2h agofirst · 4h agoExploit / PoC in the wild 6 sourcesCVE-2026-87886

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

cPanel patched critical flaw CVE-2026-65643 letting authenticated hosting customers with addon or parked domain rights execute code as root and fully compromise servers.

cPanel issued patches on August 27, 2026 for CVE-2026-65643, a flaw in domain parking and addon domain functionality in cPanel & WHM that lets an authenticated account holder create arbitrary files and execute code as root, yielding full server control. Fixed builds cover the 11.110, 11.134, 11.136 and 11.138 branches, including WP Squared 11.138.1.7, and auto-update servers receive the fix automatically. No CVSS score, published CVE record, or evidence of exploitation has appeared, and the flaw is absent from CISA's KEV catalog as of August 27. The article also recaps related 2026 cPanel-ecosystem issues, including KEV-listed LiteSpeed plugin flaws and the in-the-wild-exploited Phusion Passenger problem.

The Hacker News · 19d agoVulnerabilityCVE-2026-65643CVE-2026-58048CVE-2026-58047+3 CVEs