Urgent Security Advisory for cPanel Users

WebPros, the parent company behind cPanel and WebHost Manager (WHM), has issued a critical security alert regarding a newly discovered vulnerability that affects all currently supported versions of its hosting control panel software. The flaw resides in multiple authentication pathways, potentially allowing an attacker to gain unauthorized access to the management interface. Server administrators are strongly urged to apply the latest patches without delay.

While no official CVE identifier has been assigned at the time of this writing, the security bulletin published on Tuesday confirms the severity of the issue and outlines the necessary steps to mitigate risk. This article breaks down what the vulnerability entails, which systems are at risk, and how to protect your infrastructure.

Vulnerability Details

The core of the problem lies in the authentication mechanism that cPanel and WHM use to verify user credentials before granting access to the control panel. According to WebPros, the flaw affects various authentication paths, meaning that an exploit could be triggered through multiple entry points—such as the login page, password recovery flows, or API endpoints.

Although the company has not released specific technical details to prevent exploitation before patching, the description suggests that an attacker could bypass normal authentication checks and gain administrative-level access to the hosting control panel. Once inside, they could potentially modify server configurations, access customer data, install malicious scripts, or disrupt services.

Possible Attack Vectors

• Credential brute-force or replay attacks targeting weak authentication tokens
• Session hijacking due to improper validation of session identifiers
• Authentication bypass via crafted requests to the cPanel REST API

Given the widespread use of cPanel in shared hosting environments, a successful exploit could have cascading effects, compromising not only the server itself but also the websites and data of all hosted clients.

Affected Versions and Impact

The security alert clearly states that all currently supported versions of cPanel and WHM are vulnerable. This includes:

• cPanel & WHM version 110.x (latest stable series)
• cPanel & WHM version 108.x (long-term support)
• cPanel & WHM version 106.x (older supported branch)
• Any other version still receiving security updates from WebPros

If your server is running an unsupported version (typically those beyond three to four years old), you are not covered by this patch and should upgrade to a supported release immediately—not only to fix this flaw but also to address other known vulnerabilities.

How to Update and Protect Your Server

WebPros has already rolled out the necessary security updates. The recommended course of action is to apply the latest patch as soon as possible. Updating is straightforward for most administrators:

1. Log into your WHM interface as the root user.
2. Navigate to Home » Software » System Software Updates (or use the command line).
3. Click Check for Updates and then Run Update to install the latest cPanel & WHM version.
4. Alternatively, run /scripts/upcp --force from the command line to force an upgrade.
5. After updating, verify the installed build number matches the latest stable release listed on the cPanel documentation.

If you manage multiple servers, consider automating updates via WHM’s Update Configuration settings to ensure all nodes receive patches promptly.

Additional Mitigations

While patching is the primary defense, administrators should also review their authentication settings and enable extra layers of security:

• Enable two-factor authentication (2FA) for all cPanel/WHM user accounts, especially those with reseller or admin privileges.
• Restrict access to the cPanel and WHM login pages by IP allowlisting (using .htaccess or firewall rules).
• Regularly audit user accounts and remove any that are inactive or have suspicious permissions.
• Monitor server logs for unusual login attempts or unexpected authentication successes.

For those unable to patch immediately, implementing a strong web application firewall (WAF) rule set—such as ModSecurity with OWASP rules—can help block some exploit attempts until the update is applied.

Conclusion: Don’t Delay – Patch Now

The authentication vulnerability in cPanel and WHM represents a serious risk to hosting environments worldwide. Because the flaw affects all supported versions and can lead to full control panel takeover, the window for exposure is wide. Every hour your server remains unpatched increases the likelihood of compromise.

WebPros has acted quickly to release a fix, but it is now up to administrators to deploy it. Review the vulnerability details above, check your affected versions, and follow the update procedures. Combined with strong authentication practices, you can close this security gap and keep your hosting environment safe.

Stay tuned to official cPanel announcements and security advisories for any supplementary patches or information updates.