On August 27, 2026, cPanel pushed an unscheduled security update and sent a customer notification that most people probably skimmed past. They shouldn’t have. The flaw, assigned CVE-2026-65643, lets any authenticated cPanel account that has permission to add parked or addon domains create arbitrary files on the underlying server — which in practice means full root-level code execution.

That’s not a privilege escalation hidden behind multiple hoops. That’s a regular shared hosting customer owning the machine.

What the Flaw Actually Is

The vulnerability lives in cPanel’s domain parking functionality. When a cPanel user adds a parked domain or an addon domain, the software processes the request in a way that doesn’t sufficiently restrict where it writes files. An attacker who controls a normal cPanel account with domain-management permissions can craft a request that causes the server to write an arbitrary file to a path of their choosing.

File write as root leads to code execution as root in too many ways to enumerate. Drop a crontab, drop an SSH authorized_keys entry, write to a service configuration — the options are wide open. cPanel’s advisory doesn’t provide a proof-of-concept, and no CVE record had been published in the CVE Program’s repository as of August 28, which means the technical details haven’t been formally standardized yet. No CVSS score has been assigned.

What cPanel did say plainly: “Successful exploitation leads to code execution as the root user, giving an attacker full control of the server.”

Affected Versions and the Fix

Every supported branch is affected. The patched versions are:

  • 11.110.0.141 or later
  • 11.134.0.53 or later
  • 11.136.0.37 or later
  • 11.138.0.2 or later
  • 11.138.1.7 or later (WP Squared)

Servers configured for automatic daily updates have likely already received the patch. If you’re not sure, log in as root and run:

/scripts/upcp --force

Or go to WHM → Home → cPanel → Upgrade to Latest Version. Verify the installed build afterward under Server Configuration → Update Preferences.

Servers on end-of-life branches — anything older than the versions listed above — don’t get the fix at all. If you’re on 11.118 or 11.126, neither branch appears in the August 27 patched list. At minimum, check with cPanel about support status; the practical answer is probably “upgrade.”

The Phusion Passenger Issue Alongside This

The same week’s worth of cPanel security news also includes a separate flaw in Phusion Passenger’s Watchdog API. Phusion released Passenger 6.2.0 on August 18 to address it — the issue doesn’t have a CVE number, but Phusion’s own blog was unusually direct: “We have seen exploitation of this vulnerability in the wild at a shared hosting provider.”

Plesk updated its advisory for this flaw on August 14 with a checklist for spotting prior compromise, starting with unexpected entries in /etc/ld.so.preload. That’s a rootkit indicator. If your server uses Phusion Passenger, check whether you’re on 6.2.0 or later and review that file.

cPanel noted that the Passenger issue “does not affect default installations and applies only to servers where an affected Passenger package has been installed.” If you installed Passenger for Ruby or Node.js applications, you’re in scope.

What This Means for kalfaoglu.net Customers

kalfaoglu.net runs managed hosting, which means the underlying server software — including cPanel — is our responsibility to patch, not yours. The CVE-2026-65643 fix landed on our servers as part of the regular update cycle on or shortly after August 27.

If you’re on a self-managed VPS or dedicated server running cPanel, you need to confirm the patched version yourself. The /scripts/upcp --force command above is the fastest path.

One broader observation: this is the second critical cPanel flaw in 2026 that allows privilege escalation to root. CVE-2026-41940, the authentication bypass from April, is already in CISA’s Known Exploited Vulnerabilities catalog. CVE-2026-65643 isn’t there yet, which probably reflects how recently it was disclosed rather than any assessment that it won’t be exploited. The pattern of targeted attacks on hosting control panels has been consistent this year. “Auto-updates are on” is necessary but not sufficient — someone needs to actually verify the version periodically, especially after an unscheduled advisory like this one.

Sources