https://blog.kalfaoglu.net/tags/root-escalation/Recent content in Root-Escalation on kalfaoglu.netHugoenThu, 03 Sep 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-09-03-cpanel-cve-2026-65643-domain-parking-en/Thu, 03 Sep 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-09-03-cpanel-cve-2026-65643-domain-parking-en/<p>On August 27, 2026, cPanel pushed an unscheduled security update and sent a customer notification that most people probably skimmed past. They shouldn&rsquo;t have. The flaw, assigned CVE-2026-65643, lets any authenticated cPanel account that has permission to add parked or addon domains create arbitrary files on the underlying server — which in practice means full root-level code execution.</p> <p>That&rsquo;s not a privilege escalation hidden behind multiple hoops. That&rsquo;s a regular shared hosting customer owning the machine.</p>