Cpanel

cPanel patched a critical privilege-escalation flaw (CVE-2026-58048) that allowed an authenticated hosting customer to run SQL as the database root, with a CVSS of 9.4, via a targeted security release that also closed two other account-boundary routes.

cPanel patched three high-severity vulnerabilities after a ransomware attack compromised ~44,000 servers, illustrating an accelerated patch cycle and heightened hosting-security risk.

Hackers are actively exploiting a cPanel bug that affects millions of websites, prompting urgent patching by web hosts.