Domain parking is one of the most boring features in web hosting. A customer points a second domain name at a site they already have, clicks save, and nothing interesting happens. On cPanel servers, that click can now be turned into root access to the entire machine.
The flaw is tracked as CVE-2026-65643 and affects all supported versions of cPanel and WHM, the control panel hosting providers use to give customers self-service management of their sites. cPanel disclosed it in a security advisory on 27 August 2026 and has shipped fixed builds. Peru's national digital security centre, the CNSD, relayed it the following day in integrated security alert 160-2026, which is where we picked it up.
A save button that writes files anywhere
cPanel's advisory is four sentences long and does not waste any of them. An authenticated cPanel account holder who is able to add parked or addon domains can create arbitrary files on the server. Successful exploitation, the company says, leads to code execution as the root user, giving an attacker full control of the server and every account, website and database on it.
Note the shape of that: the file write is the bug, and root code execution is what it leads to. The account does not need to be an administrator. It needs one ordinary permission, the one that lets a customer attach another domain name to their own hosting.
cPanel's advisory carries no CVSS score, and when we checked on 29 August no record was live in the National Vulnerability Database, so there is no NIST rating either. The flaw is absent from CISA's catalogue of known exploited vulnerabilities, and the advisory does not say whether anyone has used it. That is the whole published record, and we will not extrapolate beyond it.
Why shared hosting makes this worse
The reason this rates as critical despite requiring a login is the environment it lives in. A shared hosting server holds dozens or hundreds of unrelated customers, each with their own sites, applications and databases, separated only by the controls the panel enforces. An account holder who becomes root stops being separated from anyone. The CNSD spells out what that buys an intruder: reading, altering or deleting other customers' data, planting backdoors, stealing credentials, defacing sites, adding privileged users or SSH keys, scheduling malicious cron jobs, and using the server to attack other systems.
Requiring authentication is weaker protection than it sounds, and the CNSD says so directly: cPanel credentials can be obtained through phishing, credential stuffing, compromised customer accounts, exposed passwords or access gained earlier. A provider should assume at least one of its accounts is in the wrong hands at any time. Attackers already treat the panel as a target in its own right: in June we covered an actor hijacking cPanel servers through a login bypass.
Update to these builds, then check the logs
Administrators should move to 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, or for WP2 to 11.138.1.7, or any later build on the relevant branch. Internet-facing servers first.
The CNSD also recommends inventorying every machine running cPanel or WHM to confirm it is on a supported, patched version, tightening which accounts hold parked and addon domain permissions, enforcing multi-factor authentication on administrative and customer logins, and reading back through panel and system logs for anything unusual. Given that exploitation needs only an ordinary customer login, log review is worth doing on any server that was slow to patch.
The same bulletin flagged five other issues, in Drupal Core, Palo Alto Networks PAN-OS with CAS enabled, Citrix NetScaler ADC and Gateway, ThemeFusion's Avada theme and Fusion Builder, and TrueConf Server. Two of them, the Drupal and TrueConf flaws, are already in CISA's exploited catalogue. The Citrix entry is not: the bulletin says there is currently no sign of it being exploited, and it is a different NetScaler bug from the one CISA gave federal agencies three days to patch this week. For anyone running a hosting estate, though, the cPanel entry is the one that turns a single customer account into a whole compromised server.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.