Originally published by Hacker News
- Reading Time: 5 minutes
If you run a server with cPanel or WHM, you need to read this carefully.
On May 8, 2026 — just ten days after the cPanel CVE-2026-41940 authentication bypass was used to compromise 44,000 web hosting servers and deploy ransomware — cPanel quietly released a second emergency security patch. This one covers three new vulnerabilities: CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203.
Two of the three carry a CVSS score of 8.8. That puts them firmly in theHigh severitytier, one step below Critical.
This is the second Technical Security Release (TSR) in 10 days fromcPanel. Two emergency patches in less than two weeks is not normal, and the timing — immediately following the worst cPanel attack in years — tells a clear story: the ransomware incident triggered a deeper code audit, and that audit found more problems.
What Is a cPanel TSR?
Before diving into the vulnerabilities, a quick note for context: cPanel uses a standardized process called a Technical Security Release (TSR) when a security patch is ready. cPanel notifies registered customers in advance so they can prepare update windows and maintenance schedules. CVE numbers are reserved through MITRE, but full technical details are embargoed until the moment the patch goes live — to prevent exploitation before a fix is available.
On May 7, 2026, WebPros sent a second TSR pre-disclosure email to registered customers — the second such emergency notice in ten days. The patches were released on May 8 at 12:00 EST.
The Three New Vulnerabilities
CVE-2026-29201 — Arbitrary File Read (CVSS 4.3)
What it is:An insufficient input validation of the feature file name in thefeature::LOADFEATUREFILEadminbin call that could result in an arbitrary file read.
What it means in practice:An authenticated attacker can manipulate the feature file name parameter to read files on the hosting server they should not have access to. While this does not directly grant root access, the information gathered — configuration files, credentials, internal paths — can be used to stage more damaging follow-up attacks.
Severity:Moderate (CVSS 4.3). Lower urgency than the others, but still worth patching immediately given the current threat environment.
CVE-2026-29202 — Arbitrary Perl Code Execution (CVSS 8.8)
What it is:An insufficient input validation of thepluginparameter in thecreate_userAPI call that could result in arbitrary Perl code execution on behalf of the already authenticated account’s system user.
What it means in practice:This is the most dangerous of the three. An authenticated user — which could be any account holder on a shared server — can inject arbitrary Perl code through thecreate_userAPI. Perl code running in the context of cPanel has significant system-level access. On a shared hosting server, this could allow one tenant to run code that affects the entire machine.
Severity:High (CVSS 8.8). Requires authentication, but on shared hosting, that bar is low — any account is enough.
CVE-2026-29203 — Privilege Escalation via Unsafe Symlink (CVSS 8.8)
What it is:An unsafe symlink handling vulnerability that allows a user to modify access permissions of an arbitrary file using chmod, resulting in denial-of-service or possible privilege escalation.
What it means in practice:By creating a symlink that points to a sensitive system file and triggering a chmod operation through cPanel, an attacker can change permissions on files they should not be able to touch. This can lead to privilege escalation or denial of service if system files are rendered inaccessible.
Severity:High (CVSS 8.8). In combination with CVE-2026-29202, these two flaws could be chained: execute code to create the symlink, then use the chmod escalation to gain deeper access.
Context: What Just Happened to cPanel
To understand why these three patches matter more than their individual CVSS scores suggest, it is necessary to look at what happened in the ten days before them.
On April 28, 2026, cPanel released an emergency patch for CVE-2026-41940 — a CVSS 9.8 authentication bypass that allowed unauthenticated remote attackers to gain administrative access to cPanel and WHM. The flaw was actively exploited as a zero-day with exploitation attempts dating back to late February 2026 — meaning attackers had a roughly two-month head start before a fix was available.
The consequences were immediate and severe. At least 44,000 IP addresses running cPanel were compromised in ongoing attacks. Hackers exploited the flaw to breach servers and deploy a Go-based Linux encryptor for a ransomware strain called “Sorry.”
Two emergency Technical Support Releases in a 10-day window reflects what security teams recognize as a concentrated remediation cycle: an initial critical patch triggers a deeper audit of adjacent code paths, and that audit surfaces additional issues that were previously undiscovered or deprioritized. This is not unusual following a high-profile incident — it is actually the expected outcome of an accelerated re-examination of authentication and session handling code.
In other words: finding CVE-2026-29201, 29202, and 29203 right after CVE-2026-41940 is not bad luck. It is the result of cPanel auditing their code under pressure — and finding more problems. There may be further disclosures to come.
How to Patch — Step by Step
Run this from the command line as root after 12:00 EST on May 8. This pulls the latest TSR through cPanel’s standard tier mechanism.
If automatic updates are disabled or you are on a pinned tier:
For CloudLinux 6 servers:
After patching, restart cpsrvd:
Verify the patched version is running:
Confirm the version matches the patched release listed in cPanel’s official security advisory before considering the server protected.
Should You Also Check for the Previous Compromise?
If your server was running an unpatched version of cPanel during the period between late February and April 28, you should treat it as potentially compromised and investigate, not just patch.
The recommended forensic steps include: auditing access logs retroactively from February 23, 2026 — reviewing/usr/local/cpanel/logs/access_logand/usr/local/cpanel/logs/login_logfor anomalous session authentication patterns originating from unexpected IP addresses. Also run a recursive scan of user home directories for files with the.sorryextension. Presence of.sorryfiles confirms ransomware deployment and requires full incident response, not just patching.
What is happening to cPanel right now is part of a wider trend affecting the entire web hosting security landscape.
Three of the highest-profile Linux kernel vulnerabilities in years — Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284/43500) — were disclosed within eight days of each other in late April and early May. The cPanel ransomware attack exposed over 44,000 servers. And now three more cPanel CVEs land within days of the first emergency patch.
This concentration of disclosures is not coincidental. AI-assisted security research is finding vulnerabilities faster than coordinated disclosure processes can handle them. The window between a vulnerability becoming known to attackers and being exploited in production is shrinking from weeks to days. In the case of CVE-2026-41940, exploitation started months before a patch existed.
For anyone operating cPanel servers, the operational implication is direct: automated updates must be on, patch verification must be part of your maintenance checklist, and log review after every major incident is no longer optional.
The Hacker News — cPanel, WHM Release Fixes for Three New Vulnerabilities:https://thehackernews.com/2026/05/cpanel-whm-patch-3-new-vulnerabilities.html
Panelica — cPanel Pre-Discloses Three New CVEs, Second Emergency TSR in 10 Days:https://panelica.com/blog/cpanel-cve-2026-29201-29202-29203-may-2026-tsr-advisory
Panelica — cPanel’s 30-Day Security Storm:https://panelica.com/blog/cpanel-30-day-security-storm-2026
BleepingComputer — Critical cPanel flaw mass-exploited in “Sorry” ransomware attacks:https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/
BleepingComputer — cPanel, WHM emergency update fixes critical auth bypass bug:https://www.bleepingcomputer.com/news/security/cpanel-whm-emergency-update-fixes-critical-auth-bypass-bug/
Help Net Security — cPanel zero-day exploited for months before patch release:https://www.helpnetsecurity.com/2026/04/30/cpanel-zero-day-vulnerability-cve-2026-41940-exploited/
KnownHost Community Forum — CVE-2026-29201, 29202, 29203 patch thread:https://www.knownhost.com/forums/threads/cpanel-cve-2026-29201-cve-2026-29202-and-cve-2026-29203-patch-released-5-8-26-noon-est.6603/
As an Amazon Associate, we earn from qualifying purchases at no extra cost to you.