Archive
Category: Security
cPanel CalDAV Root Flaw (CVE-2026-87899): Any Hosting Account Can Take the Whole Server
cPanel disclosed three vulnerabilities on September 23, 2026, and one of them is the shared-hosting nightmare scenario: a logged-in hosting account — any customer on the box — escalating to…
Hosting Security Roundup: October 2026 — PHP2Shell, KVM Escapes and Every CVE That Mattered
TL;DR: October’s story was PHP2Shell — two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution, exploited in the wild before the patches existed and now shipped…
PHP2Shell (CVE-2026-109618 & CVE-2026-109619): The Critical PHP RCE Flaws and How to Patch Every Panel
TL;DR: Two critical PHP vulnerabilities — nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) — let an unauthenticated attacker run code on your server before your application even executes. Exploitation…
Hosting Security Roundup: September 2026 — wp2shell, cPanel 9.9 SQLi, Plesk & WHMCS
TL;DR: September brought four critical threats hosting providers should treat as urgent: the actively exploited wp2shell WordPress RCE chain, a CVSS 9.9 SQL injection in cPanel’s EmailTrack that ends in…
Imunify360 vs CXS: Which Security Suite Does Your cPanel Server Need?
TL;DR: Imunify360 is a full automated security platform (WAF, malware scan + cleanup, patch management, reputation monitoring), while CXS is a focused exploit scanner. Both cost just $2/mo as shared…
cPanel CVE-2026-58048: The Database Root Flaw Every Host Should Patch Today
CVE-2026-58048 is a cPanel privilege escalation rated 9.4 on CVSS 4.0. An authenticated cPanel account with MySQL access can run SQL as the database root user, which can extend to…
JetBackup Best Practices
JetBackup best practices: daily full backups to an off-site destination, retention of 7 days daily / 1 month weekly / 6-12 months monthly, and a monthly restore test. Never store…
CVE-2026-48172: Critical Privilege Escalation in LiteSpeed cPanel Plugin
CVE-2026-48172 – LiteSpeed cPanel Plugin Privilege Escalation Critical vulnerability allowing root‑level command execution via the lsws.redisAble function – actively exploited in the wild. CVE-2026-48172 is a critical privilege‑escalation vulnerability in…
Urgent cPanel Security Alert: Authentication Vulnerability Explained
Critical cPanel Security Update (CVE-2026-41940) A critical authentication vulnerability has been identified in cPanel & WHM, affecting all supported versions. This issue may allow unauthorized access through certain authentication paths…
Apache Security Alert – RCE Vulnerability Fix Guide
Apache Security Alert (CVE-2026-23918) – Critical RCE Vulnerability Fix Guide A critical vulnerability has been discovered in Apache HTTP Server that may allow attackers to execute remote code (RCE). The…