Seeing these CPanel hacks remind me how old these codebases are and how much more vulnerability remain
He said he was worried but he had backups upon backups. I saw him restore a bunch of websites once, using cpanel, and I thought it is an amazing little bit of software with all of the click a button to setup many different things (like WAF). A real time saver and provides some guidance if you are not a unix-internet guru.
Not because of a fundamental limitation of that architecture, but because in practice the type of people that will use it do not want to learn or develop the necessary skills to administer it, and critical information like man pages and parameter lists are hidden.
You can't take shortcuts without consequences.
That is a nugget, it's so true.
Wrappers in general are such an issue in software. Wrappers built on top of wrappers, this desire to abstract everything away makes things look simpler, but every layer slows things down and hides what is actually happening. Every wrapper is another layer of complexity, another hoop to jump through when you're looking for a solution to a problem.
As someone who pretty much exclusively uses debian, freebsd and openbsd for server OS work, I was also rather surprised recently to see the default web gui that comes on a new fedora install.
They cannot be that bad if they are managing to be ductape of the internet.
Ever seen the upsell offers in the check-out workflow for hosting packages that come when you buy a new .com domain from any major registrar? All those are shared hosting packages where everything is done through some sort of web gui.
On the other hand, for my Linux servers, I had to do that twice in the last month with CopyFail and DirtyFrag.
I think there are just a whole lot of tools written for them. So non devs can spin things up and click some things together.
Is that safe and secure? Maybe, if the devs did their work well. But I'm positive no one reads the docs on how to configure something securely.
I think the real reason is that it's very cheap to host, and always has been
If you run a server with cPanel or WHM, you need to read this carefully.
On May 8, 2026 — just ten days after the cPanel CVE-2026-41940 authentication bypass was used to compromise 44,000 web hosting servers and deploy ransomware — cPanel quietly released a second emergency security patch. This one covers three new vulnerabilities: CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203.
Two of the three carry a CVSS score of 8.8. That puts them firmly in the High severity tier, one step below Critical.
This is the second Technical Security Release (TSR) in 10 days from cPanel. Two emergency patches in less than two weeks is not normal, and the timing — immediately following the worst cPanel attack in years — tells a clear story: the ransomware incident triggered a deeper code audit, and that audit found more problems.
Table of Contents
Before diving into the vulnerabilities, a quick note for context: cPanel uses a standardized process called a Technical Security Release (TSR) when a security patch is ready. cPanel notifies registered customers in advance so they can prepare update windows and maintenance schedules. CVE numbers are reserved through MITRE, but full technical details are embargoed until the moment the patch goes live — to prevent exploitation before a fix is available.
On May 7, 2026, WebPros sent a second TSR pre-disclosure email to registered customers — the second such emergency notice in ten days. The patches were released on May 8 at 12:00 EST.
What it is: An insufficient input validation of the feature file name in the feature::LOADFEATUREFILE adminbin call that could result in an arbitrary file read.
What it means in practice: An authenticated attacker can manipulate the feature file name parameter to read files on the hosting server they should not have access to. While this does not directly grant root access, the information gathered — configuration files, credentials, internal paths — can be used to stage more damaging follow-up attacks.
Severity: Moderate (CVSS 4.3). Lower urgency than the others, but still worth patching immediately given the current threat environment.
What it is: An insufficient input validation of the plugin parameter in the create_user API call that could result in arbitrary Perl code execution on behalf of the already authenticated account’s system user.
What it means in practice: This is the most dangerous of the three. An authenticated user — which could be any account holder on a shared server — can inject arbitrary Perl code through the create_user API. Perl code running in the context of cPanel has significant system-level access. On a shared hosting server, this could allow one tenant to run code that affects the entire machine.
Severity: High (CVSS 8.8). Requires authentication, but on shared hosting, that bar is low — any account is enough.
What it is: An unsafe symlink handling vulnerability that allows a user to modify access permissions of an arbitrary file using chmod, resulting in denial-of-service or possible privilege escalation.
What it means in practice: By creating a symlink that points to a sensitive system file and triggering a chmod operation through cPanel, an attacker can change permissions on files they should not be able to touch. This can lead to privilege escalation or denial of service if system files are rendered inaccessible.
Severity: High (CVSS 8.8). In combination with CVE-2026-29202, these two flaws could be chained: execute code to create the symlink, then use the chmod escalation to gain deeper access.
To understand why these three patches matter more than their individual CVSS scores suggest, it is necessary to look at what happened in the ten days before them.
On April 28, 2026, cPanel released an emergency patch for CVE-2026-41940 — a CVSS 9.8 authentication bypass that allowed unauthenticated remote attackers to gain administrative access to cPanel and WHM. The flaw was actively exploited as a zero-day with exploitation attempts dating back to late February 2026 — meaning attackers had a roughly two-month head start before a fix was available.
The consequences were immediate and severe. At least 44,000 IP addresses running cPanel were compromised in ongoing attacks. Hackers exploited the flaw to breach servers and deploy a Go-based Linux encryptor for a ransomware strain called “Sorry.”
Two emergency Technical Support Releases in a 10-day window reflects what security teams recognize as a concentrated remediation cycle: an initial critical patch triggers a deeper audit of adjacent code paths, and that audit surfaces additional issues that were previously undiscovered or deprioritized. This is not unusual following a high-profile incident — it is actually the expected outcome of an accelerated re-examination of authentication and session handling code.
In other words: finding CVE-2026-29201, 29202, and 29203 right after CVE-2026-41940 is not bad luck. It is the result of cPanel auditing their code under pressure — and finding more problems. There may be further disclosures to come.
Standard update:
/scripts/upcp
Run this from the command line as root after 12:00 EST on May 8. This pulls the latest TSR through cPanel’s standard tier mechanism.
If automatic updates are disabled or you are on a pinned tier:
/scripts/upcp --force
For CloudLinux 6 servers:
sed -i "s/CPANEL=.*/CPANEL=cl6110/g" /etc/cpupdate.conf
/scripts/upcp
After patching, restart cpsrvd:
/scripts/restartsrv_cpsrvd
Verify the patched version is running:
/usr/local/cpanel/cpanel -V
Confirm the version matches the patched release listed in cPanel’s official security advisory before considering the server protected.
If your server was running an unpatched version of cPanel during the period between late February and April 28, you should treat it as potentially compromised and investigate, not just patch.
The recommended forensic steps include: auditing access logs retroactively from February 23, 2026 — reviewing /usr/local/cpanel/logs/access_log and /usr/local/cpanel/logs/login_log for anomalous session authentication patterns originating from unexpected IP addresses. Also run a recursive scan of user home directories for files with the .sorry extension. Presence of .sorry files confirms ransomware deployment and requires full incident response, not just patching.
What is happening to cPanel right now is part of a wider trend affecting the entire web hosting security landscape.
Three of the highest-profile Linux kernel vulnerabilities in years — Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284/43500) — were disclosed within eight days of each other in late April and early May. The cPanel ransomware attack exposed over 44,000 servers. And now three more cPanel CVEs land within days of the first emergency patch.
This concentration of disclosures is not coincidental. AI-assisted security research is finding vulnerabilities faster than coordinated disclosure processes can handle them. The window between a vulnerability becoming known to attackers and being exploited in production is shrinking from weeks to days. In the case of CVE-2026-41940, exploitation started months before a patch existed.
For anyone operating cPanel servers, the operational implication is direct: automated updates must be on, patch verification must be part of your maintenance checklist, and log review after every major incident is no longer optional.
| Action | Priority |
|---|---|
Run /scripts/upcp to apply the May 8 TSR |
🔴 Immediate |
| Restart cpsrvd after patching | 🔴 Immediate |
Verify patched version with /usr/local/cpanel/cpanel -V |
🔴 Immediate |
| Review access logs from Feb 23 onwards | 🟡 Today |
Scan for .sorry files in home directories |
🟡 Today |
| Enable automatic cPanel updates if disabled | 🟡 This week |
Review whether any accounts may have run the create_user API anomalously |
🟡 This week |