Threat Overview
cPanel disclosed CVE-2026-65643 on August 27, 2026. An authenticated cPanel account that is permitted to add parked or addon domains can create arbitrary files on the server. Successful exploitation can lead to code execution as root, giving the attacker control over the server and all hosted accounts, websites, and databases.
The issue affects all supported cPanel & WHM versions. cPanel has published patched builds for each supported branch. The vendor advisory did not state that the vulnerability was under active exploitation.
References
Impacted Systems
| Vendor / Product | cPanel & WHM |
| Vulnerability | CVE-2026-65643 — arbitrary file creation through domain parking/addon-domain functionality |
| Affected versions | All supported cPanel & WHM versions before the fixed builds |
| Fixed builds | 11.110.0.141+; 11.134.0.53+; 11.136.0.37+; 11.138.0.2+; WP Squared 11.138.1.7+ |
| Platform | Linux hosting servers running cPanel & WHM |
| Required attacker access | Authenticated cPanel account with permission to add parked or addon domains |
| Impact | Root code execution; full server and hosted-account compromise |
| Highest-risk environment | Multi-tenant hosting where untrusted or lower-trust users can manage domains |
| Known exploitation | No broad active exploitation confirmed in the vendor advisory |
What this hunt looks for
Looks for cPanel domain-management activity, unexpected file creation by cPanel-related processes, and suspicious child-shell activity on cPanel servers.
Required logs
Syslog from Linux/cPanel servers and/or DeviceFileEvents and DeviceProcessEvents for Linux endpoints. CommonSecurityLog can provide supporting access telemetry.
First-Pass — cPanel Process Spawning Shell or File Utilities
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName has_any ("cpsrvd", "cpanel", "whostmgr")
| where FileName in~ ("sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "chmod", "chown")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated ascFollow-Up — cPanel-Related File Creation in Web Roots
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath has_any ("/home/", "/usr/local/cpanel/", "/var/cpanel/")
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where InitiatingProcessFileName has_any ("cpsrvd", "cpanel", "whostmgr") or InitiatingProcessCommandLine has_any ("cpanel", "park", "addon")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by TimeGenerated ascFollow-Up — cPanel Domain-Management Activity in Syslog
Syslog
| where TimeGenerated >= ago(30d)
| where ProcessName has_any ("cpsrvd", "cpanel", "whostmgr") or SyslogMessage has_any ("cPanel", "WHM")
| where SyslogMessage has_any ("park", "addon", "domain", "create", "file")
| project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage
| sort by TimeGenerated asc
Killian Sherer 