cPanel fixes flaw that could give hosting customers root access

Image: Primary

Published Wednesday, September 23, 2026 · 10:08 AM EDT

cPanel released a fix for a flaw in its calendar and contacts service that could let anyone with a hosting account run code as root and take control of a shared server, The Hacker News reported. The company also fixed a WP Toolkit flaw that could let one account modify another account's databases, and a separate flaw that could expose other accounts' calendar events and contacts. The root-access flaw requires a cPanel account. None of the three advisories cited known exploitation, according to the report.

Sources

The Hacker News

Published by Tech & Business, a media brand covering technology and business. This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Security Infrastructure

Pwn.ai demonstrates Firecracker guest escape on a host running it as root

Pwn.ai says it escaped a Firecracker microVM and executed a chosen operation as root on the host while the virtual machine remained accessible over SSH.

Security Infrastructure

QNAP warns of suspected NAS compromises through Plex flaws

QNAP says it has received multiple reports of suspected compromises of customers' network storage devices through the Plex2Shell vulnerability chain. The company urges users to update Plex Media Server through its App Center to version 1.43.3.10861.

Security Infrastructure

Some WordPress sites remain exposed while installing security fix

Some WordPress sites remain vulnerable to server code execution while installing the fix for actively exploited CVE-2026-119977, researcher Umut Bayram warned.

Security

Chainalysis says breach exposed password hashes and live tokens for all users

Chainalysis said hackers obtained names, usernames, password hashes and live tokens for all its users following a breach of its network security.

Security

Gnosis Pay discloses customer data breach and adds payment checks

Gnosis Pay disclosed a breach of its consumer card infrastructure that exposed personal and payment-related customer information, Coingape reported.

Security

Veeam distributes fixes for critical Linux kernel vulnerability

Veeam said on Friday that some of its products are affected by CVE-2026-98432, a critical Linux kernel vulnerability, BleepingComputer reported. The flaw allows remote unauthenticated attackers to execute commands as root on servers running Multipath TCP listeners.