CVE-2026-65643
published 2026-09-01CVE-2026-65643: Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.88%
57.3th percentile
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cpanel | cpanel | < 110.0.141 | 110.0.141 |
| cpanel | cpanel | >= 112.0.0 < 134.0.53 | 134.0.53 |
| cpanel | cpanel | >= 136.0.0 < 136.0.37 | 136.0.37 |
| cpanel | cpanel | >= 138.0.0 < 138.0.2 | 138.0.2 |
| cpanel | cpanel | >= 138.1.0 < 138.1.7 | 138.1.7 |
| webpros | cpanel | < 11.110.0.141 | 11.110.0.141 |
| webpros | cpanel | >= 11.112.0.0 < 11.134.0.53 | 11.134.0.53 |
| webpros | cpanel | >= 11.136.0.0 < 11.136.0.37 | 11.136.0.37 |
| webpros | cpanel | >= 11.138.0.0 < 11.138.0.2 | 11.138.0.2 |
| webpros | cpanel | >= 11.138.1.0 < 11.138.1.7 | 11.138.1.7 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Hackernews
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More
blogs_hackernews·2026-08-31
CVE-2026-81578 ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More
The boring parts caused most of the trouble.
A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional.
Elsewhere, fake apps, helpful support calls, cheap banking kits, exposed systems, and weak defaults kept things moving. Different attacks, same useful mistake: something familiar was trusted without a second look.
Here is the week...
## ⚡ Threat of the
Hackernews
Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
blogs_hackernews·2026-08-28
CVE-2026-65643 Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user.
The vulnerability, assigned the CVE identifier CVE-2026-65643 , impacts all supported versions of cPanel & WHM.
cPanel described the issue as a critical security vulnerability and said that an authenticated account holder who can add parked or addon domains can create arbitrary files on the server.
"Successful exploitation leads to code execution a
2026-09-01
Published