Back support.cpanel.net

40073787579671 C Panel WHM Security Update 04 28 2026

support.cpanel.net • April 29, 2026

A security issue has been identified in the cPanel software affecting all currently supported versions relating to various authentication paths.

We have pushed out a patch for the following versions:

CONFIG_TEXT: 11.110.0.97 11.118.0.63 11.126.0.54 11.132.0.29 11.136.0.5 11.134.0.20 WP Squared 11.136.1.7

Please run the following command to retrieve the patched version.

# /scripts/upcp --force

You can confirm you are on a patched version of cPanel with the following command:

# /usr/local/cpanel/cpanel -V

As long as the output matches one of the above versions, then your system has been patched.

Warning: If your server is not running a supported version of cPanel that is eligible for this update, it is highly recommended that you work toward updating your server as soon as possible, as it may also be affected.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

cPanel and WHM Critical Auth Bypass Vulnerability Patched A critical authentication vulnerability affecting all supported versions of cPanel and WHM was disclosed on April 28, 2026. This flaw allows attackers to gain unauthorized access to the control panel, posing significant risks to web hosting servers. The vulnerability has not been assigned a CVE identifier, and no technical details have been publicly disclosed. cPanel has issued an emergency update requiring administrators to run a specific command to apply the patch. Hosting providers, including Namecheap, temporarily blocked access to affected ports to protect customers until the patch was available. Administrators are urged to update immediately to prevent potential exploitation, as attackers could control hosting accounts and deploy malicious activities. The scope of impact is broad, affecting numerous web hosting providers and their customers. As of now, the vulnerability has been patched, but the lack of attribution raises concerns about future exploitation. 69 sources 72

Extracted Entities

IP Addresses (4)

11.132.0.29 11.134.0.20 11.136.0.5 11.136.1.7

Platforms (2)

cPanel WP Squared