Earlier today, cPanel disclosed a critical security vulnerability, CVE-2026-65643, affecting every supported version of cPanel & WHM. By the time the advisory finished landing in inboxes, every GillyTech server had already been patched. Not by the end of the week. Not by the end of the day. Within minutes of the notice.
That is not a brag for its own sake. It is the entire point of paying someone to manage your hosting, so let us walk through what this vulnerability is, why it is nasty, and how we handle days like this.
What CVE-2026-65643 Actually Is
The flaw lives in cPanel’s domain parking functionality, the feature that lets an account holder point additional domains at their hosting account. According to cPanel’s advisory, an authenticated cPanel user who is allowed to add parked or addon domains can abuse the feature to create arbitrary files anywhere on the server.
Arbitrary file creation sounds abstract until you follow it one step further: place the right file in the right location and you are no longer a hosting customer, you are executing code as root. Root means everything: every account on the box, every database, every mailbox, every backup.
Note the word authenticated. This is not a drive-by attack from the open internet, and that is exactly why it is dangerous on shared and reseller servers. A typical cPanel machine has dozens or hundreds of legitimate account holders. If any one of those accounts has a weak password, a reused password, or a compromised WordPress admin, an attacker does not need to break the server. They log in politely and walk up the stairs to root.
Affected and Fixed Versions
All supported versions of cPanel & WHM are affected. The patched builds are 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, and 11.138.1.7 for WP Squared, or anything later. If your server runs an end-of-life version, there is no patch coming for it; the only fix is upgrading to a supported release.
Do not wait for the automatic nightly update. Every hour between now and the patch is an hour an attacker can use, because attackers read security advisories too, and patch gaps are their favorite reading material. The exact commands are below.
Mitigation: How to Patch Right Now
If you run your own cPanel server, the fastest path is the command line. SSH in as root and force an immediate update:
/scripts/upcp --forceWhen it finishes, confirm you are on one of the patched builds listed above:
cat /usr/local/cpanel/versionPrefer the browser? In WHM, go to Home » cPanel » Upgrade to Latest Version and run the update from there, then verify the version under Server Configuration » Update Preferences. cPanel’s official update instructions cover both routes in detail, and the upcp script documentation explains what the updater does under the hood.
Two caveats: the updater needs a few gigabytes of free disk space to run, and servers on end-of-life versions will not receive this patch at all. If you are on an EOL build, upgrading to a supported version is the only mitigation.
What Happened on Our Side
The advisory arrived. Our fleet was patched and verified before this article was written, which is to say within minutes, not hours. Then we wrote the blog post.
That ordering is deliberate, and it is not new for us. When the LiteSpeed CVE dropped, we patched first and explained after. Same with the Copy Fail Linux exploit. Security work is not glamorous, and most of it is invisible when it is done right. The visible part is this: our clients have never had to email us asking if we are exposed, because the answer is published before the question forms.
Beyond emergency patching, the boring fundamentals run continuously: automatic daily updates as a floor rather than a ceiling, monitored version drift across every machine, account isolation, and infrastructure we keep aggressively current. Speed on patch day is a byproduct of the system, not heroics.
The Question Worth Asking Your Host
Days like today are a free audit of whoever runs your servers. Ask your host one question: when was CVE-2026-65643 patched on the machine my business lives on? The answer tells you almost everything about how much attention your infrastructure actually gets.
If the answer is a shrug, a ticket number, or “our platform team is evaluating the advisory,” you have learned something important while the stakes are still low. Root-level vulnerabilities do not grade on a curve.
Want your hosting handled by people who patch first and post second? GillyTech runs managed WordPress hosting and application hosting on infrastructure where security takes top priority, every single day. Schedule a call and sleep better on patch days.
