Multiple Cpanel/WHM Vulnerabilities Allow Arbitrary Command Execution On Server
cPanel patched a root command-execution flaw and two stored XSS bugs in WHM.
Stories per day · 30 days
7 stories, newest first · one card per story
Stories tagged #shared-hosting
cPanel Permissions Flaw Allows Local Users to Read Other Accounts’ Calendar Data
cPanel patched CVE-2026-68490, which lets local users on shared servers read other accounts' calendars and contacts.
2
New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts
cPanel patched a root privilege escalation and cross-tenant flaws in calendars, contacts, and WordPress databases.
New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control
cPanel patched three flaws, including a root code-execution bug any hosting account can use to seize the server.
cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access
Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.
2
Shared Hosting at Risk: LiteSpeed Enterprise Bug Can Grant Root from a Single Tenant
Critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets a low-privilege shared-hosting tenant escape CageFS isolation and gain root; forced update urged.
2
LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server
cPanel warns critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets shared-hosting account users gain root access.