If you run a server with cPanel or WHM, you need to read this carefully.
On May 8, 2026 — just ten days after the cPanel CVE-2026-41940 authentication bypass was used to compromise 44,000 web hosting servers and deploy ransomware — cPanel quietly released a second emergency security patch. This one covers three new vulnerabilities: CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203.
Two of the three carry a CVSS score of 8.8. That puts them firmly in the High severity tier, one step below Critical.
This is the second Technical Security Release (TSR) in 10 days from cPanel. Two emergency patches in less than two weeks is not normal, and the timing — immediately following the worst cPanel attack in years — tells a clear story: the ransomware incident triggered a deeper code audit, and that audit found more problems.
Table of Contents
Before diving into the vulnerabilities, a quick note for context: cPanel uses a standardized process called a Technical Security Release (TSR) when a security patch is ready. cPanel notifies registered customers in advance so they can prepare update windows and maintenance schedules. CVE numbers are reserved through MITRE, but full technical details are embargoed until the moment the patch goes live — to prevent exploitation before a fix is available.
On May 7, 2026, WebPros sent a second TSR pre-disclosure email to registered customers — the second such emergency notice in ten days. The patches were released on May 8 at 12:00 EST.
What it is: An insufficient input validation of the feature file name in the feature::LOADFEATUREFILE adminbin call that could result in an arbitrary file read.
What it means in practice: An authenticated attacker can manipulate the feature file name parameter to read files on the hosting server they should not have access to. While this does not directly grant root access, the information gathered — configuration files, credentials, internal paths — can be used to stage more damaging follow-up attacks.
Severity: Moderate (CVSS 4.3). Lower urgency than the others, but still worth patching immediately given the current threat environment.
What it is: An insufficient input validation of the plugin parameter in the create_user API call that could result in arbitrary Perl code execution on behalf of the already authenticated account’s system user.
What it means in practice: This is the most dangerous of the three. An authenticated user — which could be any account holder on a shared server — can inject arbitrary Perl code through the create_user API. Perl code running in the context of cPanel has significant system-level access. On a shared hosting server, this could allow one tenant to run code that affects the entire machine.
Severity: High (CVSS 8.8). Requires authentication, but on shared hosting, that bar is low — any account is enough.
What it is: An unsafe symlink handling vulnerability that allows a user to modify access permissions of an arbitrary file using chmod, resulting in denial-of-service or possible privilege escalation.
What it means in practice: By creating a symlink that points to a sensitive system file and triggering a chmod operation through cPanel, an attacker can change permissions on files they should not be able to touch. This can lead to privilege escalation or denial of service if system files are rendered inaccessible.
Severity: High (CVSS 8.8). In combination with CVE-2026-29202, these two flaws could be chained: execute code to create the symlink, then use the chmod escalation to gain deeper access.
To understand why these three patches matter more than their individual CVSS scores suggest, it is necessary to look at what happened in the ten days before them.
On April 28, 2026, cPanel released an emergency patch for CVE-2026-41940 — a CVSS 9.8 authentication bypass that allowed unauthenticated remote attackers to gain administrative access to cPanel and WHM. The flaw was actively exploited as a zero-day with exploitation attempts dating back to late February 2026 — meaning attackers had a roughly two-month head start before a fix was available.
The consequences were immediate and severe. At least 44,000 IP addresses running cPanel were compromised in ongoing attacks. Hackers exploited the flaw to breach servers and deploy a Go-based Linux encryptor for a ransomware strain called “Sorry.”
Two emergency Technical Support Releases in a 10-day window reflects what security teams recognize as a concentrated remediation cycle: an initial critical patch triggers a deeper audit of adjacent code paths, and that audit surfaces additional issues that were previously undiscovered or deprioritized. This is not unusual following a high-profile incident — it is actually the expected outcome of an accelerated re-examination of authentication and session handling code.
In other words: finding CVE-2026-29201, 29202, and 29203 right after CVE-2026-41940 is not bad luck. It is the result of cPanel auditing their code under pressure — and finding more problems. There may be further disclosures to come.
Standard update:
/scripts/upcpRun this from the command line as root after 12:00 EST on May 8. This pulls the latest TSR through cPanel’s standard tier mechanism.
If automatic updates are disabled or you are on a pinned tier:
/scripts/upcp --forceFor CloudLinux 6 servers:
sed -i "s/CPANEL=.*/CPANEL=cl6110/g" /etc/cpupdate.conf
/scripts/upcpAfter patching, restart cpsrvd:
/scripts/restartsrv_cpsrvdVerify the patched version is running:
/usr/local/cpanel/cpanel -VConfirm the version matches the patched release listed in cPanel’s official security advisory before considering the server protected.
If your server was running an unpatched version of cPanel during the period between late February and April 28, you should treat it as potentially compromised and investigate, not just patch.
The recommended forensic steps include: auditing access logs retroactively from February 23, 2026 — reviewing /usr/local/cpanel/logs/access_log and /usr/local/cpanel/logs/login_log for anomalous session authentication patterns originating from unexpected IP addresses. Also run a recursive scan of user home directories for files with the .sorry extension. Presence of .sorry files confirms ransomware deployment and requires full incident response, not just patching.
What is happening to cPanel right now is part of a wider trend affecting the entire web hosting security landscape.
Three of the highest-profile Linux kernel vulnerabilities in years — Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284/43500) — were disclosed within eight days of each other in late April and early May. The cPanel ransomware attack exposed over 44,000 servers. And now three more cPanel CVEs land within days of the first emergency patch.
This concentration of disclosures is not coincidental. AI-assisted security research is finding vulnerabilities faster than coordinated disclosure processes can handle them. The window between a vulnerability becoming known to attackers and being exploited in production is shrinking from weeks to days. In the case of CVE-2026-41940, exploitation started months before a patch existed.
For anyone operating cPanel servers, the operational implication is direct: automated updates must be on, patch verification must be part of your maintenance checklist, and log review after every major incident is no longer optional.
| Action | Priority |
|---|---|
Run /scripts/upcp to apply the May 8 TSR | 🔴 Immediate |
| Restart cpsrvd after patching | 🔴 Immediate |
Verify patched version with /usr/local/cpanel/cpanel -V | 🔴 Immediate |
| Review access logs from Feb 23 onwards | 🟡 Today |
Scan for .sorry files in home directories | 🟡 Today |
| Enable automatic cPanel updates if disabled | 🟡 This week |
Review whether any accounts may have run the create_user API anomalously | 🟡 This week |
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。