The precondition is the finding. cPanel says an authenticated account holder who can add parked or addon domains can create arbitrary files on the server [3], and that successful exploitation "leads to code execution as the root user, giving an attacker full control of the server" [4]. Every supported version of cPanel and WHM is in scope [2]. The August 27 notification does not say whether a Team User sub-account holding permission over parked and addon domains qualifies as that account holder [c11b], while July's Exim advisory said that flaw may allow privilege escalation from Team User sub-accounts [11]. Until cPanel answers, resellers who delegate domain management should assume the sub-account counts.
Verification takes a minute. Read the installed build in WHM under Server Configuration > Update Preferences, force the update as root with /scripts/upcp --force, or take it from Home > cPanel > Upgrade to Latest Version [8]. Servers on automatic daily updates already have it [7]. Servers on an end-of-life version get nothing until they move to a supported branch [9], and that population overlaps with the next problem.
July's three cPanel advisories named fixed builds in the 11.118 and 11.126 branches [10]. The August 27 list names 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2 and, for WP Squared, 11.138.1.7 [5]. Two branches that were receiving fixes 27 days earlier are absent [24][27], and cPanel has not said whether they remain supported [10]. DNSOnly is not named either [6].
The paperwork is thin. There is no CVSS score in the customer notification, and The Hacker News found no CVE Program record for CVE-2026-65643 when it checked on August 28, one day after the advisory [12][26], though the records for CVE-2026-58048 and CVE-2026-58047 from July 31 were both live at that check [12]. cPanel has not claimed exploitation, and the flaw is absent from CISA's KEV catalog as of the August 27 release [13]. KEV already carries three cPanel-ecosystem entries [25]: the LiteSpeed plugin privilege escalation that any cPanel user account can use to run scripts as root, added May 26 [14]; a symlink-following flaw in the same plugin, added June 15 for shared hosting on CloudLinux or CageFS where the user has FTP or web shell access [15]; and April's authentication bypass, listed with known use in ransomware campaigns [16].
There is no interim mitigation and no way to check whether a server was already used [17]. cPanel produces that guidance when it decides to: for the Phusion Passenger issue on August 14 it shipped a command to grep the Apache error log [18], and Plesk, developed by parent company WebPros alongside cPanel, published a five-item compromise checklist beginning with unexpected entries in /etc/ld.so.preload [20], with the note that "patching closes the vulnerability going forward, but it does not undo anything an attacker may have already done" [21].
Keep those two threads apart. The in-the-wild exploitation Phusion reported at a shared hosting provider [23] concerns the Watchdog API flaw it fixed in Passenger 6.2.0 on August 18, which carries no CVE identifier [22] and reaches only servers where an affected Passenger package is installed [19]. Nothing public connects it to CVE-2026-65643.
