#cPanel
All CosmicBytez Labs articles tagged #cPanel, across news, security advisories, how-to guides, and projects.
- News
LiteSpeed Enterprise Flaw Lets One Hosting Account Seize Root on Shared Servers
A LiteSpeed Web Server Enterprise flaw before v6.3.7 bypasses CageFS isolation, letting one low-privilege hosting account gain root on shared servers.
- Security
CVE-2026-67401: cPanel EmailTrack SQL Injection Leads to Root Code Execution
A mail-privileged cPanel account can abuse EmailTrack's SQL injection flaw to write arbitrary files and execute code as root on the server.
- Newsletter
June 17 Digest: Teams C2 Evasion, Copilot Data Theft, iRhythm Breach, cPanel KEV
DragonForce hides C2 inside Microsoft Teams relay traffic; a SearchLeak attack weaponizes M365 Copilot for one-click data exfiltration; iRhythm confirms...
- News
CISA Warns of Another Actively Exploited cPanel Plugin Flaw
CISA has added CVE-2026-54420, an actively exploited vulnerability in the LiteSpeed cPanel user-end plugin, to its Known Exploited Vulnerabilities catalog...
- Security
CVE-2026-54420: LiteSpeed cPanel Plugin Symlink Escape on Shared Hosting
A high-severity symlink vulnerability in the LiteSpeed cPanel plugin (CVSS 8.5) allows users with FTP or web shell access to escape CloudLinux/CageFS...
- Security
CVE-2026-47365: WordPress Toolkit Argument Injection in cPanel & WHM
A critical CVSS 9.9 argument injection vulnerability in WordPress Toolkit before 6.11.0 allows remote authenticated users to bypass cross-tenant...
- News
CISA Gives Feds 4 Days to Patch Actively Exploited cPanel Plugin Flaw
CISA's emergency directive gives federal agencies four days to patch the actively exploited LiteSpeed cPanel plugin flaw being weaponized in the wild.
- News
CISA Urges Immediate Patching of Exploited LiteSpeed cPanel
CISA has added a LiteSpeed cPanel plugin zero-day to its Known Exploited Vulnerabilities catalog after active exploitation allowed attackers to execute scripts.
- Security
CVE-2026-45247 — Mirasvit Magento 2 Cache Warmer PHP Object Injection RCE
CVSS 9.8 PHP object injection in Mirasvit Full Page Cache Warmer for Magento 2 lets unauthenticated attackers achieve RCE — patch to 1.11.12 now.
- News
LiteSpeed cPanel Plugin CVE-2026-48172 Exploited to Run
A maximum-severity vulnerability in the LiteSpeed User-End cPanel Plugin, tracked as CVE-2026-48172 with a CVSS score of 10.0, is under active...
- News
Exploit Frenzy Threatens Millions via Critical cPanel
A critical authentication bypass flaw in cPanel/WHM has triggered a wave of exploit activity, with multiple proof-of-concept exploits now public and...
- News
cPanel & WHM Release Fixes for Three New Vulnerabilities
cPanel has released security updates addressing three vulnerabilities in cPanel and Web Host Manager (WHM), including flaws enabling privilege escalation,...
- News
Critical cPanel Flaw Mass-Exploited in 'Sorry' Ransomware
A newly disclosed critical vulnerability in cPanel and WHM tracked as CVE-2026-41940 is being mass-exploited by ransomware actors to breach web hosting...
- News
Critical cPanel and WHM Bug Exploited as Zero-Day, PoC Now
The critical CVE-2026-41940 authentication bypass vulnerability in cPanel, WHM, and WP Squared is being actively exploited in the wild and has been...
- Security
CVE-2026-41940: WebPros cPanel & WHM and WP2 Missing
WebPros cPanel, WHM, and WP2 (WordPress Squared) contain a critical authentication bypass in the login flow, allowing unauthenticated remote attackers to...
- News
cPanel & WHM Emergency Update Fixes Critical Auth Bypass Bug
cPanel and WebHost Manager have released an emergency patch for a critical authentication bypass vulnerability that allows attackers to gain control panel...