[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_ATkPK1mWDDv8X4paJXacp_eArNlgrege_78UDvPKpU":3},{"article":4,"iocs":38,"watch_terms":49,"solutions":50,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"6c537708-37c7-4091-9dda-4a6f0d4bc2da","New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control","new-cpanel-flaw-lets-a-hosting-account-run-code-as-root-take-full-server-control-879d2d","A flaw in cPanel's CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take \"full control of the server,\" the company said on September 22. A second bug in the WP Toolkit plugin, used to install and manage WordPress sites, allows an account holder to change databases that belong to other accounts. cPanel has released fixed versions for both,","Two critical vulnerabilities have been disclosed in cPanel's CalDAV\u002FCardDAV service and WP Toolkit plugin. The first allows any cPanel account holder to execute code as root, granting full server control. The second enables an account holder to modify databases belonging to other accounts. A third, less severe flaw allows local users to read other accounts' calendar and contact data. cPanel has released patches for all issues.","cPanel flaws allow hosting account holders to gain root access and control servers.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fnew-cpanel-flaw-lets-hosting-account_0272795595.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhT5quc0dmRWhh6WOC80Gx9QoHTMYyq5srnXBXjybOKZk_qoUn1Q2nKLE9MifqCEyRIha_NFvRsyr8Nx5EyxGIREXaTb5Fh59cz4Ln8yZj9Zv7piqM49wmm7rfmchW1cVlss1wn47qNypaYarZUVNHBO8rzXaYTvRMi9u1phgfXVd8OZx8_Vjxm34684BE\u002Fs1600\u002Fcpanel-0day.jpg","2026-09-23T12:16:00+00:00","2026-09-23T14:00:08.783216+00:00",9,[17,20,22],{"name":18,"type":19},"cPanel & WHM","product",{"name":21,"type":19},"WP Toolkit",{"name":23,"type":24},"WebPros","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},[39,43,46],{"type":40,"value":41,"context":42},"cve","CVE-2026-87899","cPanel CalDAV\u002FCardDAV root code execution vulnerability",{"type":40,"value":44,"context":45},"CVE-2026-87900","WP Toolkit plugin vulnerability allowing database modification of other accounts",{"type":40,"value":47,"context":48},"CVE-2026-68490","cPanel CalDAV\u002FCardDAV vulnerability allowing reading of other accounts' calendar events and contacts",[23,18,21],{"controls":51,"vendors":139},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":82,"name":83,"problem":84,"products":85},"patch-management","Automated patch management","Known holes get closed in days, not months.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":111,"name":112,"problem":113,"products":114},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":156},"cpanel-root-privilege-escalation-highlights-hosting-platform-patch-urgency","cPanel Root Privilege Escalation Highlights Hosting Platform Patch Urgency","Critical vulnerabilities in cPanel's CalDAV\u002FCardDAV service and WP Toolkit plugin allowed any authenticated account holder to execute code with root privileges, effectively handing full server control to an unprivileged user. This is a severe privilege escalation failure — shared hosting environments are particularly dangerous because many untrusted users share the same underlying system, meaning one compromised or malicious account can compromise every tenant on the server. The cross-account database modification flaw further violates the principle of least privilege and tenant isolation. These flaws matter because hosting providers running unpatched cPanel installations expose not only their own infrastructure but every customer and website hosted on those servers. cPanel has released patches, making rapid deployment the most critical remediation step.",[145,146,147,148,149,150,151,152,153,154,155],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 CM-6: Configuration Settings","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","OWASP A01:2021 – Broken Access Control","ITIL Change Management: Emergency Change Procedures","GDPR Article 32: Security of Processing (relevant where hosted data is EU personal data)",{}]