cPanel’s September 29 Security Fixes: Verify the Build, Not the Checkbox

A hosting control panel is supposed to save administrators time. Giving somebody else your administrative powers is a rather excessive interpretation of that brief.

On September 29, cPanel published three advisories worth putting on your maintenance list. They concern the Multilang adminbin, WHM account modification, and WHM SSL management. The practical lesson: check the installed build, apply the relevant update, and record the result. “Automatic updates are enabled” is a setting, not evidence that an update succeeded.

What the advisories actually say

CVE-2026-93698: Multilang adminbin concerns insufficient input validation that permits arbitrary commands. cPanel describes the impact as execution with root privileges, potentially exposing the entire server and its hosted accounts. The notice does not specify the authentication prerequisites or report active exploitation; this article makes neither claim.

CVE-2026-93697: account modification is stored cross-site scripting in WHM’s Mass Modify Accounts interface. An unprivileged account holder can cause script to run in a WHM administrator’s session, enabling administrative actions under that identity.

CVE-2026-93029: SSL management describes the same kind of session-level impact in WHM’s Manage SSL Hosts interface. This concerns the management interface; the advisory does not say that TLS encryption itself has been broken.

These are different failure modes. One reaches server commands; the other two reach the administrator through the browser. A security review that examines only publicly visible websites can miss the tools used to manage them.

Which builds contain the fixes?

All three notices list the same patched builds for their respective release lines:

Compare your installation with its own release line. Do not compare the final number in isolation or assume a higher major number automatically includes a particular fix. If your installation falls outside the versions listed, ask the vendor about a supported upgrade path instead of guessing.

A maintenance plan that leaves evidence

Start by identifying who manages the server. Shared-hosting customers usually need an answer from their provider; administrators of their own installations need to inspect the build themselves. Keep the server name, current version, planned target, and maintenance contact together in the change record.

Before updating, my recommendation is to check that you have a recent, usable backup and a recovery plan. Decide how you will obtain help if panel access fails. This is ordinary operational preparation, not an excuse to postpone a security update indefinitely. A backup you cannot restore is mainly an optimism archive.

cPanel’s update instructions offer a WHM route: sign in as root, open Home → cPanel → Upgrade to Latest Version, and select Click to Upgrade. The documented command-line option, run as root by the server administrator, is:

/usr/local/cpanel/scripts/upcp --force

Afterward, verify the installed build against the table and review the update result. I also recommend checking routine operations: panel login, a representative website, mail access, and certificate management. Write down what you actually tested. A successful command exit and a functioning customer workflow answer different questions.

What this means for kalfaoglu.net customers

If you use a managed hosting account, ask whether the server hosting your account is on a patched build. There is no reason for a customer to experiment with root commands to answer that question. If you manage a VPS yourself, establish whether panel maintenance is your responsibility or included in your service.

Do not infer that a server was compromised merely because it needed an update. Equally, patching does not establish that an earlier compromise never happened. If suspicious administrative activity has already appeared, preserve the relevant logs and involve the administrator in a separate investigation.

The useful outcome this week is straightforward: a verified patched version and a short maintenance record. Security work gets much easier when the answer to “Did we update?” is something better than “Probably.”