cPanel and WebHost Manager (WHM) are essential administrative platforms used by hosting providers worldwide to manage servers, websites, and databases.
Because of their massive global footprint, any security gaps in these systems are prime targets for cybercriminals.
On May 8, 2026, security researchers disclosed three severe vulnerabilities impacting cPanel, WHM, and the WP Squared platform.
These flaws can lead to arbitrary code execution, sensitive data exposure, and denial-of-service conditions, prompting the vendor to release emergency patches that administrators must apply immediately.
New Vulnerabilities Discovered in cPanel and WHM
The most critical of the three flaws is tracked as CVE-2026-29202, which involves a dangerous Perl code-injection vulnerability.
This issue originates within the create_user API call and is directly linked to how the system handles the plugin parameter.
If an attacker successfully exploits this weakness, they can inject and execute malicious Perl scripts on the underlying server.
This grants threat actors extensive administrative access, jeopardizing all hosted websites, customer data, and backend server configurations.
A second major vulnerability, identified as CVE-2026-29201, enables arbitrary file reads across the server. This security flaw exists in the feature::LOADFEATUREFILE adminbin call, which fails to validate user-provided file names properly.
By passing a relative path as an argument to this administrative function, attackers can manipulate the system into making any arbitrary file world-readable.
Consequently, unauthorized users could easily extract sensitive system configurations, proprietary user information, and database credentials.
The third issue, CVE-2026-29203, is caused by the unsafe handling of symlinks. This structural vulnerability allows a local user to execute a chmod command on arbitrary files.
By manipulating file permissions through maliciously crafted symlinks, an attacker can intentionally break system operations to trigger a denial-of-service attack.
Researchers also warn that threat actors could potentially chain this symlink manipulation with other techniques to achieve local privilege escalation.
To mitigate these severe threats, the software vendor has released comprehensive security patches across multiple release branches.
System administrators using cPanel and WHM must immediately update their environments to version 11.136.0.9 or later.
The security team has also deployed backported patches for older software tracks, spanning versions 11.134, 11.132, 11.130, 11.126, and 11.124 series, alongside several older legacy branches.
Furthermore, environments running the WP Squared platform are affected and must be upgraded to version 11.136.1.10 to ensure full protection.
For legacy hosting providers still maintaining CentOS 6 or CloudLinux 6 architecture, the vendor provided a direct update to version 110.0.114.
Administrators running these outdated systems must first change their update configuration file to use the cl6110 tier before applying the patch.
Security teams can initiate the upgrade directly from the server command line by running the /scripts/upcp –force command.
Once the installation completes, administrators should execute /usr/local/cpanel/cpanel -V to check the current build number and confirm the server is secured against potential exploitation.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
%20(1)%20(1).webp?fit=1600,900&ssl=1&description=These flaws can lead to arbitrary code execution, sensitive data exposure, and denial-of-service conditions, prompting the vendor){kind=link}