#cpanel — Web Hosting News

cPanel patched three vulnerabilities on July 29, across every supported branch. Two matter most on shared servers: an unauthenticated request-smuggling bug that can alter other users' responses, and a database flaw that lets an ordinary account reach admin rights and possibly the host itself.

Three months after cPanel's emergency patch, attackers have turned GitHub Actions into a distributed fleet that scans the internet for servers still exposed to CVE-2026-41940 and harvests their cloud keys, tokens and database logins. How it works, and what to check.

Almost everything hosts depend on has gone up fast: energy, hardware, consolidation, and above all software licensing, from cPanel's post-2019 climb to Broadcom's VMware reset. Part one of a three-part series on what is really driving hosting costs up.

A zero-click stored XSS in Roundcube webmail, scored CVSS 7.2, lets a crafted plain-text email run script in a victim's session on preview. Roundcube fixed it on July 5, cPanel shipped it in 134.0.45 on July 14, and standalone installs still need patching separately.

CVE-2026-41940 was exploited as a zero-day for 68 days before a patch existed. CISA was breached via Ivanti vulnerabilities it had just ordered patched. Volt Typhoon had 5-year US infrastructure access. The case-by-case record of how government networks keep getting owned.

CVE-2026-48172 in LiteSpeed User-End cPanel Plugin (2.3-2.4.4) lets any authenticated cPanel user run arbitrary scripts as root. CVSS 10.0, actively exploited, on the CISA KEV list. Patch to WHM Plugin 5.3.1.0 / cPanel Plugin 2.4.7 immediately.

Skynethosting took its entire cPanel fleet offline on May 1 in response to CVE-2026-41940, and as of May 14 some customer servers had been down for nearly two weeks, with one reseller publicly reporting a 30 percent client loss during the outage.

cPanel's May 13 patch covers five new CVEs, but security researcher Shubham Shah reported within hours that the fix for CVE-2026-29205 is incomplete and all cPanel instances remain exploitable until a working patch lands.

On May 8, cPanel closed three new vulnerabilities and Linux distributions shipped DirtyFrag kernel fixes. Two weeks of disclosures left providers with three separate patch tracks. Here is the complete status and the confirmations every shared hosting customer should request.

Change Healthcare's $3.1 billion in breach costs is the new normal of what a serious compromise sets in motion: parallel notification clocks across GDPR, NIS2, DORA, and HIPAA; personal liability for CISOs and boards; and a cyber insurance market with conditions that can deny coverage at the worst moment.

Three new cPanel vulnerabilities, CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203, are being patched today at 12:00pm EST, with technical details withheld until the fix is live.

CVE-2026-41940, the cPanel authentication bypass exploited for 64 days before disclosure, is still developing. 44,000 servers likely compromised, a public exploit on GitHub, three active campaigns. This page is updated in real time as new information surfaces.

CVE-2026-41940, the cPanel authentication bypass from April 28, was being exploited since February 23, operated as a zero-day for 64 days, and was added to CISA's Known Exploited Vulnerabilities list with 1.5 million internet-exposed instances counted by Rapid7.

cPanel disclosed a critical authentication bypass on April 28 affecting nearly all versions of cPanel and WHM, with active exploits confirmed in the wild before the patch was released, forcing hosting.com, Namecheap, KnownHost, HostPapa, and InMotion Hosting to take cPanel access offline globally.

A recent discussion on WebHostingTalk - “I need feedback on Webuzo” - triggered an interesting exchange among hosting operators testing Webuzo as a potential alternative to cPanel. Reading through the thread and

A recent thread on WebHostingTalk - “A personal and honest perspective on cPanel - beyond pricing complaints” - triggered a long discussion among hosting operators about cPanel’s direction in 2026. Reading through

Change is coming to the world of web hosting automation - and it’s going to affect nearly every WHMCS user. Early in 2026, specifically on January 1st, WHMCS will roll out a new pricing structure that marks one of the most significant adjustments in recent years. For many hosting providers, developers, and digital agencies, this announcement has already sparked conversations and some concern about rising operational costs and long-term sustainability.

January 1, 2026. According to industry sources and partner communications, this update will introduce an average price increase of approximately 26%, alongside a structural change in how subscriptions are billed. These updates follow Plesk’s established pattern of annual price adjustments and reflect broader changes within the WebPros group’s commercial strategy.

As has become tradition, cPanel has once again announced updated licensing prices — and, as usual, the hosting community’s reaction ranges from weary sighs to outright frustration. Starting January 1, 2026, new pricing will take effect, and while the increases aren’t surprising, they will certainly sting for many administrators and resellers.

.ab-wrap{ max-width:940px; margin:0 auto; padding:36px 22px; font:400 18px/1.78 Inter,system-ui,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif; color:#0f172a; background:transparent; } .ab-kicker{display:inline-block;font-size:12px;font-weight:800;letter-spacing:.12em;text-transform:uppercase;color:#64748b;margin-bottom:10px;} .ab-lead{font-size:20px;line-height:1.9;margin:8px 0 22px;color:#111827;} .ab-hr{height:1px;border:0;background:linear-gradient(90deg,#e6e7eb,transparent);margin:30px 0;} h2{font-weight:800;font-size:30px;margin:18px 0 12px;color:#071029} h3{font-weight:800;font-size:22px;margin:16px 0 10px;color:#071029} p{margin:0 0 16px} .ab-list{list-style:none;margin:10px 0 18px;padding:0} .ab-list