ONE HOSTING ACCOUNT. FULL SERVER CONTROL.

The cPanel vulnerabilities putting shared hosting under the microscope

Your website may be perfectly updated.

Your WordPress plugins may be patched.

Your password may be strong.

And yet…

someone with another hosting account on the same server could potentially become root.

That is the uncomfortable reality behind a series of recently disclosed vulnerabilities affecting cPanel & WHM, one of the most widely used control panels for managing web hosting.

And this isn't just another WordPress vulnerability.

We're talking about vulnerabilities that can cross the boundary between:

ONE CUSTOMER → THE ENTIRE SERVER

Nigeria's national cybersecurity response team, ngCERT, recently warned about the critical CVE-2026-65643, a flaw that could allow an authenticated cPanel customer with certain domain-management permissions to create arbitrary files and ultimately execute code as root. Successful exploitation could give an attacker control over the server and every account, website and database hosted on it.

But the story didn't stop there.

On September 22, cPanel disclosed another root-level vulnerability, CVE-2026-87899, affecting its CalDAV/CardDAV functionality. An authenticated cPanel account could potentially escalate privileges and execute code as root.

And another flaw in the same September 22 release could allow a customer to access information belonging to other accounts, while a separate WP Toolkit vulnerability could allow cross-account database manipulation.

The big question isn't:

"Is my website secure?"

It's:

"Is the SERVER hosting my website secure?"

WHAT MAKES THIS SO SERIOUS?

Shared hosting works on a simple idea.

One physical or virtual server can host:

Website A

Website B

Website C

Website D

…and potentially hundreds of other customers.

Each customer gets their own account.

Ideally, those accounts should be isolated.

Customer A should not be able to access Customer B.

Customer B should not be able to access Customer C.

And nobody except the server administrator should have root-level control.

That's the security boundary.

The problem is that several recent cPanel vulnerabilities have demonstrated ways that this boundary can fail.

THE cPANEL FLAW THAT STARTED THE ALARM

CVE-2026-65643 was disclosed by cPanel on August 27.

The vulnerability affected cPanel's domain parking and add-on domain functionality.

An authenticated account holder who could add parked or add-on domains could exploit the flaw to create arbitrary files on the underlying server.

According to cPanel, successful exploitation could lead to code execution as root, giving an attacker full control over the server and every account, website and database hosted on it.

ngCERT classified the issue as:

CRITICAL CVSS 9.8

The Nigerian advisory specifically warned website administrators, businesses, government organizations and hosting providers to treat the issue as a high-priority patching requirement.

And here's why Nigerian businesses should pay attention:

Domain management is a normal hosting function.

This isn't some bizarre feature that nobody uses.

THEN CAME ANOTHER ROOT-LEVEL FLAW

On September 8, cPanel disclosed CVE-2026-67401, involving its EmailTrack functionality.

An authenticated cPanel account with mail-related privileges could create arbitrary files on the server through the vulnerable functionality.

cPanel states that successful exploitation leads to code execution as root, giving the attacker full control of the server.

Think about the progression:

A normal hosting account

↓

A vulnerable cPanel feature

↓

Arbitrary file creation

↓

Code execution

↓

ROOT

And once an attacker has root…

The conversation changes completely.

SEPTEMBER 22: MORE TROUBLE

Then came another cPanel security release.

cPanel disclosed CVE-2026-87899, affecting CalDAV/CardDAV functionality.

An authenticated cPanel account holder could escalate privileges through the vulnerable functionality.

The impact?

Code execution as root.

cPanel's advisory says successful exploitation gives an attacker full control of the server.

The same release also addressed:

CVE-2026-68490

A permissions issue that could expose calendar events and contact information belonging to other accounts.

And:

CVE-2026-87900

A WP Toolkit vulnerability that could allow a logged-in cPanel user to modify databases belonging to other accounts.

Now the pattern becomes impossible to ignore.

This isn't one isolated bug.

It's a series of weaknesses affecting the security boundaries that shared-hosting customers depend on.

THE SHARED-HOSTING PROBLEM

Imagine renting an apartment in a large building.

You have:

Your door

Your room

Your keys

Your belongings

The people next door have theirs.

You expect the walls and locks to keep everyone separated.

Now imagine discovering that a person renting the apartment next door can somehow get the master key to the building.

That's essentially the concern with a root-level shared-hosting vulnerability.

Your website may not be vulnerable.

Your neighbor's compromised account might be the starting point.

And your server could still become the target.

WHAT HAPPENS AFTER ROOT ACCESS?

Root is not just another user account.

It is essentially the highest level of control on a Linux server.

With root-level access, an attacker could potentially:

Read files belonging to other accounts
Modify websites
Access databases
Steal credentials
Alter server configurations
Create malicious administrator accounts
Deploy malware
Install persistent backdoors
Intercept sensitive information
Tamper with logs
Attack other websites on the same server

The exact consequences depend on the environment and what the attacker does, but cPanel explicitly describes successful exploitation of the root-level flaws as giving full server control.

One account can become a doorway into everything.

YOUR WORDPRESS MAY NOT BE THE PROBLEM

This is where many website owners get confused.

They think:

"I updated WordPress, so I'm safe."

Not necessarily.

You can have:

WordPress — Updated

Plugins — Updated

Themes — Updated

Strong password — Yes

2FA — Enabled

…and still be sitting on an unpatched hosting environment.

Because WordPress security and server security are not the same thing.

Your website is an application.

cPanel is part of the infrastructure managing the environment around it.

Securing one does not automatically secure the other.

WHY THIS MATTERS IN NIGERIA

This should immediately get the attention of:

Nigerian SMEs
Web developers
Digital agencies
Hosting resellers
E-commerce businesses
Schools
NGOs
Government websites
Financial-service businesses
Bloggers
Freelancers
Anyone running multiple websites on shared hosting

Many small businesses don't operate their own servers.

They buy hosting.

And that means they are trusting someone else to maintain the underlying infrastructure.

Your website could be secure while your hosting environment isn't.

That's why the ngCERT advisory is particularly important for Nigerian organizations.

It explicitly targets organizations, businesses, government agencies, website administrators and hosting providers.

THE HOSTING PROVIDER PROBLEM

There's another layer here.

A normal website owner may not even have the ability to patch cPanel.

Your hosting company does.

That creates a simple but important question:

Who is responsible for patching the server your website lives on?

If the answer is:

"My hosting provider."

Then don't assume.

Verify.

Ask them:

"What cPanel/WHM build are you currently running, and have the September 2026 security patches been applied?"

That's a perfectly reasonable security question.

WHAT SHOULD HOSTING PROVIDERS DO?

If you're managing cPanel/WHM infrastructure, patching should be treated as urgent.

For CVE-2026-65643, cPanel lists fixed builds including:

11.110.0.141+
11.134.0.53+
11.136.0.37+
11.138.0.2+

with WP Squared 11.138.1.7 or later.

For CVE-2026-87899, cPanel lists:

11.134.0.57+
11.136.0.41+
11.138.0.8+

with WP Squared 11.138.1.11 or later.

For CVE-2026-67401, patched builds include:

11.110.0.143+
11.134.0.55+
11.136.0.39+
11.138.0.4+

with WP Squared 11.138.1.9 or later.

Don't just update one component and assume everything is covered.

Check the exact security advisories and verify the installed builds.

WEBSITE OWNERS: WHAT CAN YOU DO?

You may not control the server.

But you can still take action.

1️⃣ ASK YOUR HOST

Ask whether your cPanel/WHM environment has been patched against the recent vulnerabilities.

2️⃣ KNOW YOUR ENVIRONMENT

Find out whether you're using:

Shared hosting

VPS

Dedicated server

Cloud hosting

Your security responsibilities differ considerably.

3️⃣ DON'T SHARE CREDENTIALS

Your hosting login shouldn't be casually shared with developers, staff or contractors.

When access is necessary, use individual accounts where possible.

4️⃣ ENABLE MFA

If your hosting provider supports multi-factor authentication, use it.

A stolen password should not automatically become a stolen hosting account.

5️⃣ BACK UP OUTSIDE THE SERVER

If your only backup lives on the same server that gets compromised…

That's not much of a backup.

Maintain separate, protected backups.

6️⃣ WATCH FOR STRANGE CHANGES

Look for:

Unknown files
New administrator accounts
Unexpected redirects
Modified website files
New cron jobs
Unknown email accounts
Suspicious database changes
Unexpected outbound traffic

A clean website today doesn't prove the server was never compromised.

AND THERE'S A BIGGER LESSON HERE

We've spent years telling website owners:

"Keep WordPress updated."

That's good advice.

But the modern web stack is much bigger than WordPress.

Your attack surface includes:

Domain registrar

↓

DNS

↓

Hosting control panel

↓

Operating system

↓

Web server

↓

Database

↓

CMS

↓

Plugins

↓

Themes

↓

Third-party integrations

↓

Your users

An attacker doesn't have to attack the weakest-looking component.

They attack the weakest available path.

THE NEW SECURITY MINDSET

Instead of asking:

"Is my website secure?"

Start asking:

"What is my website sitting on?"

Then ask:

Who manages it?

Who patches it?

Who has administrative access?

Can another customer reach it?

Where are my backups?

What happens if the hosting panel is compromised?

Those questions are much closer to real-world security.

ONE SERVER. MANY TARGETS.

Here's why shared hosting is so attractive to attackers.

One successful compromise could potentially expose multiple opportunities.

Instead of:

Target → Attack → Repeat

an attacker may encounter:

One server

↓

Many customer accounts

↓

Many websites

↓

Many databases

↓

Many email accounts

↓

Many potential victims

That's why tenant isolation is so important.

And why vulnerabilities that cross that boundary deserve immediate attention.

OSMALLAMINTECH TAKE

The biggest mistake a website owner can make right now is thinking:

"My WordPress is updated, so I'm safe."

Cybersecurity doesn't work that way.

Your website is only one layer.

Behind it is an entire infrastructure stack.

And recent cPanel vulnerabilities show exactly what can happen when the boundary between one hosting account and the underlying server breaks down.

One account.

One vulnerability.

One server.

Potentially everything.

The website you worked so hard to protect could be sitting beside dozens or hundreds of other websites on infrastructure you don't control.

So the next time your hosting provider says:

"Everything is fine."

Don't panic.

Just ask one simple question:

"Are you patched?"

OSMALLAMINTECH QUESTION

If you run a business website on shared hosting:

Do you know what security version your hosting server is running right now?

YES — I check my hosting environment

NO — I only worry about WordPress

Which one are you?

OSMALLAMINTECH
Cybersecurity Awareness | Threat Intelligence | Digital Resilience