cPanel Releases Emergency Patch for Critical Authentication Flaw

Gbhackers •Divya • April 29, 2026

Web hosting administrators must take immediate action, as cPanel has rolled out an emergency security update to address a critical vulnerability. Disclosed on April 28, 2026, this flaw impacts various authentication paths within the cPanel and WebHost Manager (WHM) ecosystem. Control panels like cPanel act as the central nervous system for web servers, handling everything […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

cPanel and WHM Critical Auth Bypass Vulnerability Patched A critical authentication vulnerability affecting all supported versions of cPanel and WHM was disclosed on April 28, 2026. This flaw allows attackers to gain unauthorized access to the control panel, posing significant risks to web hosting servers. The vulnerability has not been assigned a CVE identifier, and no technical details have been publicly disclosed. cPanel has issued an emergency update requiring administrators to run a specific command to apply the patch. Hosting providers, including Namecheap, temporarily blocked access to affected ports to protect customers until the patch was available. Administrators are urged to update immediately to prevent potential exploitation, as attackers could control hosting accounts and deploy malicious activities. The scope of impact is broad, affecting numerous web hosting providers and their customers. As of now, the vulnerability has been patched, but the lack of attribution raises concerns about future exploitation. 51 sources 72

Extracted Entities

Platforms (1)

cPanel