[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxmz47pWidTEZ13ObqLlA0kJs-1D1kPXJ3kTrcothfrE":3},{"article":4,"iocs":44,"watch_terms":58,"solutions":59,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"155a30a3-476a-4cda-9d7f-da75bd37bb74","Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server","critical-cpanel-flaw-could-let-one-hosting-customer-take-root-control-of-a-whole-c079f1","cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user. The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported versions of cPanel & WHM. cPanel described the issue as a critical security vulnerability and said that an","A critical vulnerability in cPanel and WebHost Manager (WHM) allows authenticated users to gain root access to a server by exploiting domain parking and addon domain functionality. Patches have been released for supported versions, and administrators are urged to update immediately. The vulnerability, CVE-2026-65643, could lead to full server compromise.","Critical cPanel flaw allows root control of servers via domain parking.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fcritical-cpanel-flaw-could-let-one.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjtKp2lGcxPfp8ymA88FIBXB0Bn9fcUSaU_UIl1pfAjDSC2usRwUE73vhQEeP6jar9U9k10yotgyYl_tIk6dQA-MFIr2bJ3LN_azGt9kDU6hpW448HgmBuJbc6TWSo1vfpmhoK0J3_5rhF6VIpWd7NYf0G1YSYHdqKubWgQwa1yU6KRAL-bnDGd8HmCmPk\u002Fs1600\u002Fcpanel-root.jpg","2026-08-28T09:45:15+00:00","2026-08-28T12:00:09.720518+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"cPanel","product",{"name":21,"type":19},"WebHost Manager (WHM)",{"name":23,"type":19},"LiteSpeed cPanel plugin",{"name":25,"type":19},"Phusion Passenger",{"name":27,"type":19},"Plesk",{"name":29,"type":30},"WebPros","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},[45,49,52,55],{"type":46,"value":47,"context":48},"cve","CVE-2026-65643","Critical cPanel vulnerability allowing root code execution.",{"type":46,"value":50,"context":51},"CVE-2026-48172","Privilege escalation in LiteSpeed cPanel plugin.",{"type":46,"value":53,"context":54},"CVE-2026-54420","Symlink-following flaw in LiteSpeed cPanel plugin.",{"type":46,"value":56,"context":57},"CVE-2026-41940","Authentication bypass patched in April, used in ransomware.",[29,18,21],{"controls":60,"vendors":148},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":91,"name":92,"problem":93,"products":94},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":120,"name":121,"problem":122,"products":123},"patch-management","Automated patch management","Known holes get closed in days, not months.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":163},"cpanel-flaw-enables-root-takeover-of-shared-hosting-servers","cPanel Flaw Enables Root Takeover of Shared Hosting Servers","A critical vulnerability in cPanel and WHM allows any authenticated user to escalate privileges to root level by abusing domain parking and addon domain features — functionality present in virtually every shared hosting environment. This is particularly dangerous because shared hosting servers house multiple customers, meaning one malicious or compromised account could expose every other tenant on the same server. The flaw highlights the risk of privilege escalation vulnerabilities in widely-deployed hosting control panels that are often slow to be patched by hosting providers. Because cPanel is ubiquitous in web hosting, the attack surface is enormous, and delayed patching leaves entire hosting infrastructures — and their customers — critically exposed.",[154,155,156,157,158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Controlled Use of Administrative Privileges","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-6: Audit Record Review and Reporting","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","ITIL Change Management: Emergency Change Procedures","GDPR Article 32: Security of Processing (for hosted customer data at risk)",{}]