cPanel patched a critical flaw, CVE-2026-65643, that could let one authenticated hosting customer with domain controls execute code as root and take over an entire server.
That is not a little website glitch. Root means the keys to the whole machine. On shared hosting, that machine is also running your site, your email, your customer database, and everyone else parked on the same box.
What CVE-2026-65643 actually means
You do not need to be a wizard to follow this. cPanel is the control panel most cheap and mid-range web hosts still use. You log in, you manage domains, you upload files, you click around. The catch is that a lot of customers share one physical server.
This bug sits in that setup. An account that already has domain controls, meaning a normal paying customer, not some outsider on the open internet, could run code as root. Once you are root, the walls between customers are gone. You can read other people’s files, grab databases, mess with mail, and plant whatever you want.
cPanel issued a patch. That is the good news. A patch only helps if your host actually installed it.
Why shared hosting makes this a bigger problem
Big outfits with dedicated servers have one tenant: themselves. Shared hosting is different. Your bakery site, a random blog, and a sketchy landing page can all sit on the same hardware. You never picked your neighbors. You also never got a vote on whether they know how to keep a password.
If one of those neighbors is sloppy, or hostile, this kind of hole turns their cPanel login into a master key. That is the part that pisses me off. Regular folks pay a host to keep this stuff from happening. Then the software that runs the building has a door that leads straight to the basement.
Authenticated here is the word that matters. This is not a random stranger knocking from outside. It is someone who already has an account and domain controls on that server. On shared hosting, that describes half the building.
What you should do this week
Do not wait for a polite email that may never come. Hosts are uneven about this. Some patch fast. Some sit on it.
- Ask your host, in writing, whether they have applied the cPanel patch for CVE-2026-65643.
- If you run your own cPanel server, update it now. Do not put it on next week’s list.
- After the patch is in, change the important passwords: cPanel, FTP, databases, and your site admin login.
- Pull a fresh backup you actually control, not just the copy sitting on the same server.
- If the host cannot tell you they patched it, that is your answer. Start looking at moving.
You are not being paranoid. You are treating a shared machine like a shared machine. One customer should never be able to own the whole building. That is not a feature. That is a failure.
Keep your own data under your own control as much as you can. The host will talk about uptime. You should be talking about who else has the keys.
Primary Source: https://thehackernews.com/2026/08/critical-cpanel-flaw-could-let-one.html