One cPanel account can own the whole server: patch today

On a shared hosting server, your site’s neighbors are strangers with logins. A new cPanel bug lets any one of them run code as root, and root means every site, mailbox, and database on that box.

Hosts need to update before the weekend. Everyone else should ask their host whether they have.

On shared hosting, your neighbor’s login can become the whole server.

The 5-Minute Cyber Brief

Know what matters before your first meeting.

Weekday mornings. Five minutes. What changed in security, why it matters.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

What happened

On September 22, cPanel disclosed CVE-2026-87899, a flaw in its CalDAV and CardDAV service, which stores each account’s calendars and contacts. It lets a logged-in account holder execute code as root and take “full control of the server.” cPanel lists no requirement other than having an account. It affects cPanel & WHM version 120 and later.

Two companion bugs shipped the same day:

• CVE-2026-87900 (WP Toolkit 6.11.2-10794 and older): a logged-in cPanel user can modify databases in other accounts. The CVE record goes further and describes reading arbitrary files and executing code across customer accounts.
• CVE-2026-68490: a local user can read other accounts’ calendar events and contacts.

All three are credited to researcher Ali Mustafa (rz1027).

Why it matters

Shared hosting sells accounts to the public. On an unpatched server, any customer, or anyone who phished one customer’s login, can become root and reach every other tenant.

No exploitation has been reported, and the bugs weren’t in CISA’s KEV catalog as of September 23. But cPanel offers no workaround, so patching is the only control. It’s the second hosting-panel escalation this month after the Acronis backup plugin for cPanel, and it lands the same week as the exploited WordPress Core bug many of these servers also host.

What to do first

1. Update cPanel & WHM to 11.134.0.57, 11.136.0.41, or 11.138.0.8 or later (WP Squared: 11.138.1.11+). In WHM: Home › cPanel › Upgrade to Latest Version, or run /usr/local/cpanel/scripts/upcp --force as root.
2. Update WP Toolkit to 6.11.3 or later with cPanel’s installer command. cPanel hasn’t said whether auto-update will pick it up.
3. Move off older lines. Servers on 120–133 need a fixed release line; cPanel lists fixed builds only for 134, 136, 138 and WP Squared.
4. Customers on shared hosting: ask your provider to confirm both updates are done.

Details

• CVE-2026-87899: CalDAV/CardDAV, execution with unnecessary privileges (CWE-250) → authenticated account holder runs code as root. cPanel & WHM 120+.
• CVE-2026-87900: WP Toolkit ≤ 6.11.2-10794, argument injection → cross-account database changes (CVE record: file read and code execution across accounts). Fixed in 6.11.3.
• CVE-2026-68490: CalDAV/CardDAV incorrect permissions → read other accounts’ calendars and contacts (CVSS 4.0: 8.2).
• Fixed builds: 11.134.0.57, 11.136.0.41, 11.138.0.8; WP Squared 11.138.1.11. The update also repairs calendar and contact permissions for existing accounts.
• Exploitation: none reported; not in KEV as of 2026-09-23.

Hunt / verify

• Run /usr/local/cpanel/cpanel -V to confirm the build, and check the WP Toolkit package version.
• Review for unexpected root-owned processes started from the CalDAV/CardDAV service, new SSH keys in /root/.ssh, and new cron jobs.
• Look for accounts making unusual CalDAV/CardDAV requests before your update date.
• If a hosted WordPress site shows signs of tampering, follow our hacked WordPress site checklist.

cPanel → 11.134.0.57 / 11.136.0.41 / 11.138.0.8+ and WP Toolkit 6.11.3+; no workaround; shared-hosting customers ask the host.

Hosting and web-panel fixes like this land in the CyberExperts Daily Brief each weekday morning, so you know what to ask your host.

Sources

• The Hacker News: New cPanel flaw lets a hosting account run code as root (Sep 23, 2026)
• CVE-2026-87899 record
• CVE-2026-87900 record
• CIRCL: CVE-2026-68490

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].