cPanel flaw lets a low-privilege hosting account seize root on the whole server

A critical flaw in cPanel and WHM, the dominant web hosting control panel, lets a low-privilege but authenticated account take root control of an entire server. Tracked as CVE-2026-65643, the bug lives in the domain-parking feature, which is enabled in virtually every shared and reseller hosting environment. Any account allowed to add parked or addon domains can create arbitrary files anywhere on the underlying server, leading to code execution as root. No advanced skills or chained bugs are needed, only a legitimate low-tier login obtainable through a cheap hosting plan or a compromised account. On shared hosting, one such account can compromise every site, database, and mailbox on the box.

Check

Apply cPanel's patched builds immediately, and while patching, review which accounts can add parked or addon domains and temporarily restrict that permission on unpatched servers.

Affected

Hosting providers and administrators running unpatched cPanel and WHM (CVE-2026-65643); an authenticated account with domain-parking permission can create files as root and take over the whole server, endangering every tenant on it.

Fix

Patch to a fixed cPanel build, confirm automatic updates applied, restrict domain-parking privileges meanwhile, monitor for unexpected files and root processes, and treat any compromised shared server as an incident.