[cpanel]

September 24, 2026

• WordPress CVE-2026-87902 moves from scanning to code execution. Patchstack saw the first malicious requests at 17:44 UTC on 22 September — recon began under five hours after 7.1.2 shipped — and traffic has since risen tenfold, with a third stage that swaps pearcmd's config-show for config-create to write attacker-controlled files to disk. RCE needs an active theme with a top-level directory named page-* plus a readable local .php file; the official PHP Docker image and default cPanel configs on PHP before 8.5 qualify (BleepingComputer) (earlier coverage). · Vulnerabilities & Exploits
• cPanel CalDAV/CardDAV flaw gives any hosting account root. cPanel lists no prerequisite beyond having an account, which on a shared server means any paying customer — or anyone with a customer's login. Fixed in 11.134.0.57 / 11.136.0.41 / 11.138.0.8 and WP Squared 11.138.1.11, with no workaround offered; a separate WP Toolkit bug lets a logged-in user modify other accounts' databases. No exploitation reported (The Hacker News). · Vulnerabilities & Exploits

in The Exploit Is Public, the Ubuntu Patch Isn't

August 29, 2026

• cPanel/WHM fixed CVE-2026-65643, a critical flaw in domain parking and addon-domain handling that allows code execution as root across all supported versions — one hosting tenant to full server compromise (The Hacker News). · Vulnerabilities & Exploits

in PaperCut Ships a Second Emergency Patch After Researchers Bypass the First