Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To determine whether a hosting control panel is vulnerable, record its complete product name, release tier, and build number, then compare that exact build with the vendor’s security advisory. For cPanel & WHM, several 2026 flaws require urgent checking: one was actively exploited to bypass authentication, another carried a CVSS score of 9.4, and a third carried CVSS 9.8 and could lead from an authenticated domain-management account to root-level code execution.
On a self-managed server, check the build with /usr/local/cpanel/cpanel -V, update through WHM or the vendor updater, run the command again, restart cpsrvd, and complete the vendor’s compromise check and log review. If a hosting company manages the server, obtain the exact build, patch time, affected-CVE status, and compromise-check result in writing; a generic statement that the panel is “up to date” is not enough.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhat counts as a vulnerable hosting control panel?
A panel is vulnerable when the installed build falls within the affected range for a specific security issue. The product name alone does not establish safety: two cPanel servers can run different release tiers and builds, with one patched and the other still exposed.
This guide covers cPanel & WHM, DNSOnly, and WP Squared because the documented 2026 advisories concern those products. The build thresholds below are not rules for Plesk, DirectAdmin, or another panel. Those products require their own advisories and version checks.
#1 Best Overall
- Unauthenticated exposure: an attacker may reach the vulnerable administration service without a valid account.
- Authenticated exposure: an attacker needs a panel login or a particular permission, but a compromised or low-privilege account can still be dangerous.
- Cross-account or root impact: a defect can escape one hosting account and affect other tenants or the server itself.
- Patch status: a build at or above the fixed build for its release tier addresses that CVE, but it does not prove that other CVEs are fixed or that an earlier intrusion did not occur.
How do I identify the panel product and exact build?
On a server where you have shell access
- Log in with an account that can run administrative commands.
- Run
/usr/local/cpanel/cpanel -V. - Save the complete output, including the release tier and every digit of the build number. Do not record only the major version.
- Confirm whether the host is running cPanel & WHM, DNSOnly, or WP Squared before matching the result to an advisory.
The command’s output is your baseline. Keep it with the date and the server name so you can prove which build was present before and after maintenance.
When you do not have shell or WHM access
Ask the hosting provider for the exact installed product and build, not just a package name or a statement that it runs the latest version. Request the date and time of the last security update as well. If the provider cannot supply those details, treat the patch status as unknown rather than assuming the panel is protected.
How do I compare my build with the 2026 cPanel vulnerabilities?
Match the release tier first, then compare the complete build with the fixed build for that tier. The following table summarizes the documented thresholds and the exposure each issue creates.
| Issue | What exploitation can do | Affected or fixed-build information | Severity and urgency |
|---|---|---|---|
| CVE-2026-41940 | Bypass authentication on cPanel/WHM administration interfaces. | The ACSC alert does not state a single fixed build in the available summary. Use the current cPanel advisory for the installed release tier and apply its stated fix. | Australian Signals Directorate Australian Cyber Security Centre (ACSC) reported active exploitation on 1 May 2026 and advised immediate review and patching. |
| CVE-2026-58048 | Authenticated database privilege escalation with possible cross-account impact. | Builds below 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, and 11.136.0.32 are affected. The corresponding number is the minimum fixed build for that tier. | CVSS 9.4 out of 10, according to the Cyber Security Agency of Singapore in 2026. |
| CVE-2026-65643 | An authenticated user with domain-adding rights could create arbitrary files and potentially execute code as root. | Fixed cPanel/WHM builds are 11.110.0.141, 11.134.0.53, 11.136.0.37, and 11.138.0.2 or later. WP Squared is fixed at 11.138.1.7 or later. | CVSS 9.8, according to ngCERT in 2026. |
How should I read the build thresholds?
Suppose a server is on the 11.134 tier. A build ending in 0.47 is below the 11.134.0.48 threshold for CVE-2026-58048 and remains affected; 0.48 or a later 11.134 build meets that CVE’s stated fix level. For CVE-2026-65643 on the same tier, the relevant comparison is 11.134.0.53. Do not compare a 11.134 build with the fixed number for 11.136 or 11.110.
If your build is older than the listed release lines, or the tier is no longer supported, move to a supported cPanel release instead of trying to apply a partial fix. Release-tier differences are why a generic “latest” badge without a recorded number is poor evidence.
Where do I confirm that a cPanel security fix is included?
cPanel’s version-specific change logs identify security fixes with the exact label Security Update. Security announcements are also distributed through cPanel’s security and news channels. Use those records to verify both the CVE identifier and the fixed build for your tier.
Recommended Free Tools
- Open the vendor advisory or change log that names the CVE.
- Check that the advisory covers your product: cPanel & WHM, DNSOnly, or WP Squared.
- Confirm the fixed build listed for your release tier.
- Compare that number with the output saved from
/usr/local/cpanel/cpanel -V. - Record the advisory date and the comparison in your maintenance notes.
Do not treat a general operating-system update, a web-application update, or a panel restart as proof that the CVE fix is present. The installed cPanel build is the deciding evidence.
How do I apply the latest cPanel patch safely?
Prepare before changing the server
- Take and verify current backups of accounts, databases, configuration, and any custom integrations.
- Schedule a maintenance window appropriate for the server’s workload. Updates can restart panel services and may take longer on large installations.
- Make sure you can reach the server through a separate administrative path if the web interface becomes unavailable.
- Record the pre-update build and note which CVEs you are addressing.
- Tell other administrators and customers about any expected service interruption.
Run the update
- Use the WHM upgrade interface, selecting the supported release and update offered for the installed tier.
- For the domain-parking issue covered by CVE-2026-65643, ngCERT specifically identifies the vendor updater
/scripts/upcp --forceor the WHM upgrade interface as update methods. Run it with the privileges required by your installation and follow the updater’s completion output. - Wait for the updater to finish. Do not terminate it because the progress appears slow; an interrupted update can leave services or package metadata inconsistent.
- Save the updater log or completion message, including any packages that were skipped or any request to retry.
- If the updater reports that your release line is unsupported, stop treating the server as patched and plan the supported-release upgrade.
A maintenance command is remediation only when it installs a build that meets the advisory’s threshold. Running an updater without checking the resulting build leaves the important question unanswered.
How do I verify that the patch actually installed?
- Run
/usr/local/cpanel/cpanel -Vagain and save the complete post-update output. - Compare the new tier and build with every fixed build relevant to your server, not only the CVE that prompted the maintenance.
- Restart the cPanel service with
/scripts/restartsrv_cpsrvd, as documented by NHS England Digital. - Reconnect to WHM and confirm that the service returns normally and that routine administration pages respond.
- Record the final build, restart time, updater result, and the administrator who performed the work.
If the command still reports the old build, the update did not complete or the server is using a different installation than the one you changed. Stop and investigate the updater log rather than declaring success.
How can I tell whether the server was compromised before patching?
An update does not undo actions an attacker may already have taken. Because CVE-2026-41940 was observed in active exploitation and the other issues allow high-impact authenticated actions, perform a separate compromise assessment after patching.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Run the vendor’s assessment
Use the cPanel-provided detection or compromise-assessment script referenced by the relevant advisory. Follow the script’s instructions exactly, save its output, and escalate any positive or inconclusive result to your incident-response process. Do not substitute a clean update log for this assessment.
Review the right evidence
- Authentication records: look for successful or failed logins from unfamiliar addresses, unusual times, or accounts that should not have administrative access.
- WHM and panel activity: check for unexpected account creation, privilege changes, domain additions, parked domains, API keys, or service-setting changes.
- Web and database logs: investigate unfamiliar database commands, uploads, file writes, or requests that coincide with suspicious panel activity.
- System records: look for new privileged users, altered scheduled tasks, changed startup files, unexpected binaries, and unexplained service restarts.
- File integrity: compare recently modified files with deployment records, paying particular attention to executable files and configuration files.
Preserve relevant logs before rotating them. If you find evidence of unauthorized root access, isolate the host according to your incident plan and involve qualified responders; simply reinstalling the panel may not remove persistence elsewhere on the server.
What can I do if patching is delayed?
Temporary exposure reduction is useful only until the update can be installed. It is not a substitute for correcting the vulnerable code.
- Restrict internet access to WHM and other administration interfaces to trusted addresses or a private management network.
- Require the strongest available administrative authentication and remove unused accounts and keys.
- For the domain-parking or add-on-domain issue, disable the affected feature where your operational requirements permit.
- Increase alerting on authentication failures, new domains, privilege changes, file creation, and service restarts.
- Tell stakeholders that these controls reduce reachability but do not establish that the server is safe.
ACSC’s guidance is to apply patches as soon as practicable when required. Keep a specific maintenance time and owner rather than leaving the server in a temporary state indefinitely.
How should managed-hosting customers verify a provider’s patch?
Ask the provider for a written response tied to your server or account. A provider-wide statement may not prove that your particular node runs the fixed build.
Rank #4
- Request the panel product and complete installed build, including the release tier.
- Request the patch timestamp and the maintenance method used.
- Ask whether the fixed build for CVE-2026-41940, CVE-2026-58048, and CVE-2026-65643 is installed, or whether a different tier-specific advisory applies.
- Ask whether the provider ran the cPanel compromise-assessment tool and reviewed authentication, WHM, web, database, and system logs.
- Keep the response with your own security records and ask for notification of any rollback or future exception.
If support replies only with “we run the latest version,” ask again for the numeric build. If the provider cannot provide it, classify the status as unknown and escalate through its security channel or begin a migration assessment.
How do self-managed and provider-managed responses differ?
| Decision point | Self-managed server | Provider-managed server |
|---|---|---|
| Build evidence | Run /usr/local/cpanel/cpanel -V and retain the output. |
Obtain the complete build and timestamp from the provider. |
| Advisory matching | Match the installed tier to cPanel’s fixed-build entry. | Ask which tier and fixed-build entry the provider used. |
| Patch action | Use the WHM upgrade interface or the documented updater during a maintenance window. | Open a security-maintenance request and obtain confirmation when it completes. |
| Compromise review | Run the vendor assessment and inspect the listed logs yourself or through responders. | Require confirmation that the assessment and log review were performed on your node. |
| Interim control | Restrict administration interfaces and disable affected features where practical. | Request network restrictions or feature disablement from the provider while waiting. |
What should I do when the build is unsupported or the update fails?
The server is on an unsupported release line
Do not infer safety from an old build that is higher than one threshold but outside the supported tiers. Plan an upgrade to a supported cPanel release, test account compatibility, and take verified backups before the change.
The updater completes but the build does not change
Check the updater output for a skipped package, repository error, disk-space problem, or failed dependency. Confirm that you ran the command on the server that actually hosts the affected WHM instance, then contact cPanel support or your provider with the pre-update and post-update outputs.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The service will not restart
Do not repeatedly force restarts without preserving diagnostics. Capture the service output and relevant logs, keep administration access restricted, and obtain vendor or provider assistance; a failed restart can indicate an incomplete update or a separate configuration problem.
The provider gives conflicting version information
Send the provider the exact output you received, ask which node handled your account, and request a single authoritative build and timestamp. Until the discrepancy is resolved, treat the host as unverified and keep temporary access restrictions in place.
Best Value
- Comes with secure packaging
- It can be a gift item
- Easy to read text
The compromise check finds suspicious activity
Preserve evidence, limit network exposure, and activate your incident-response procedure. Patch the vulnerable software, but do not erase logs or assume the update removed attacker persistence.
What is the minimum evidence that a patch is complete?
You should be able to show five records: the pre-update build, the advisory and tier-specific fixed build, the updater result, the post-update build and service restart, and the compromise-assessment and log-review results. Together they demonstrate both code remediation and a check for misuse. A missing build number or missing compromise review leaves a material gap even when the update command reported success.
Frequently Asked Questions
Can a CVSS score by itself tell me whether I must patch immediately?
No. CVSS describes technical severity, while exposure and exploitation activity determine practical urgency. The actively exploited authentication bypass warrants immediate attention even though the available alert summary does not provide one universal fixed-build number; the 9.4 and 9.8 scores reinforce the need to match your tier and patch promptly.
Do these cPanel build numbers apply to Plesk or DirectAdmin?
No. The thresholds are specific to cPanel-family products and WP Squared. For another panel, identify its exact product and build, then use that vendor’s security advisory and fixed-version guidance.
Is a full server reboot required after updating cPanel?
The documented verification procedure calls for restarting the cPanel service with /scripts/restartsrv_cpsrvd and confirming normal operation. Reboot the entire server only if the vendor or your maintenance plan specifically requires it; a reboot is not evidence that the CVE fix or a compromise assessment was completed.
What if I cannot obtain any version information from my hosting company?
Treat the security state as unknown, not patched. Restrict access to administrative interfaces where you can, open an escalation with the provider’s security team, and request a numeric build, patch timestamp, relevant-CVE status, and compromise-check confirmation before relying on the service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
