On September 8, 2026, cPanel published a security advisory disclosing a critical privilege-escalation vulnerability affecting every supported version of cPanel and WHM. The flaw lives in EmailTrack, cPanel's mail-tracking component, and allows an authenticated hosting account holder — one with only mail-related privileges — to create files of their choosing anywhere on the server, then leverage that arbitrary file write to execute code as root.
Read that again if you run shared hosting infrastructure: a single low-privileged cPanel account, the kind sold for a few dollars a month, can take complete control of the underlying server. Every other tenant on that box, every database, every mailbox, every SSL private key — exposed.
This is the shared-hosting nightmare scenario. The entire business model of multi-tenant hosting rests on account isolation. When a mail-privileged account can write arbitrary files as root, that isolation is gone.
Why Defenders Need to Act Now
- Blast radius is total. This is not a website defacement bug. Root on a shared hosting server means access to every tenant's data, the ability to pivot into adjacent infrastructure, install persistent backdoors, skim payment data, and use the box for staging attacks against third parties.
- The attacker's starting position is trivially cheap. Threat actors routinely purchase or compromise legitimate hosting accounts as operational infrastructure. An authenticated-account requirement is no meaningful barrier — it is the standard operating model for abuse of hosting platforms.
- All supported versions are affected. There is no "we're on the old branch, we're safe" escape hatch here. If you run cPanel/WHM, assume exposure until patched.
- File-write primitives are extremely flexible. Arbitrary file creation as root can be converted to code execution through cron, systemd units, sudoers, SSH authorized_keys, web-accessible payloads, or library hijacking. Defenders must assume post-exploitation tradecraft will vary widely.
Technical Analysis
Affected Products and Versions
| Product | Affected Versions | Component |
|---|---|---|
| cPanel & WHM | All supported versions | EmailTrack (mail tracking subsystem) |
The advisory explicitly states that every supported version of cPanel and WHM is affected. There is no version carve-out. Environments running End-of-Life cPanel branches are also likely vulnerable and will not receive fixes — an additional reason to migrate off EOL tiers.
How the Vulnerability Works (Defender's View)
Based on cPanel's disclosure:
- Precondition: The attacker holds an authenticated cPanel account with mail-related privileges. This is a standard capability for any account that can create and manage email accounts — i.e., nearly every cPanel end-user account.
- Primitive: Through EmailTrack, the attacker can cause the server to create files at attacker-chosen paths. Because EmailTrack operations are performed with elevated privileges in the cPanel architecture, the file write is not confined to the user's home directory.
- Escalation: The arbitrary file creation is converted into root code execution. Classic conversion paths an attacker would use include:
- Dropping a cron job into
/etc/cron.d/that executes as root - Writing a systemd unit into
/etc/systemd/system/and triggering it - Planting an SSH key into
/root/.ssh/authorized_keys - Dropping a web-accessible payload into a vhost document root served by a privileged process
- Overwriting or planting libraries/configuration consumed by root-owned services
- Dropping a cron job into
Exploitation Status
As of cPanel's September 8 advisory and initial reporting:
- Confirmed active exploitation: Not publicly confirmed at time of publication
- Public PoC: Not yet widely observed
- CISA KEV: Not listed at time of publication
Do not let the absence of confirmed exploitation lull you. Arbitrary-file-write-to-root bugs in hosting control panels have a long history of rapid weaponization once technical details circulate. Shared hosting providers are high-value targets precisely because one compromise yields hundreds or thousands of victim sites. Treat this as patch-now, hunt-immediately severity.
Detection & Response
The exploitation chain produces concrete, observable artifacts: unexpected files in privileged locations, root-owned processes spawned from cPanel/mail service contexts, and new persistence mechanisms. The detections below target those behaviors rather than the specific exploit primitive, which means they will also catch post-exploitation activity from other cPanel bugs.
Sigma Rules
---
title: Suspicious File Creation in Privileged Linux Persistence Directories
id: 3f8a1c92-6d4e-4b7a-9c15-2e8f4a1b9d03
status: experimental
description: Detects creation of files in cron, systemd, sudoers, or root SSH directories, consistent with abuse of the cPanel EmailTrack arbitrary file write flaw to establish root-level persistence.
references:
- https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account.html
- https://attack.mitre.org/techniques/T1053/003/
- https://attack.mitre.org/techniques/T1543/002/
author: Security Arsenal
date: 2026/09/10
tags:
- attack.persistence
- attack.privilege_escalation
- attack.t1053.003
- attack.t1543.002
- attack.t1098.004
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|startswith:
- '/etc/cron.d/'
- '/etc/cron.daily/'
- '/etc/cron.hourly/'
- '/etc/systemd/system/'
- '/etc/sudoers.d/'
- '/root/.ssh/'
- '/etc/ld.so.preload'
filter_package_manager:
Image|endswith:
- '/apt'
- '/apt-get'
- '/dpkg'
- '/yum'
- '/dnf'
- '/rpm'
condition: selection and not 1 of filter_package_manager
falsepositives:
- Legitimate package installation and system administration activity
- Configuration management tooling (Ansible, Puppet, Chef) writing managed files
level: high
---
title: Root Shell or Command Execution Spawned From cPanel or Mail Services
id: 8c2e5d17-4a9f-4b3c-b6e1-7d5a3f0c9e28
status: experimental
description: Detects interactive shells or command interpreters spawned as root with a parent process belonging to cPanel, Exim, or Dovecot. A strong indicator of successful EmailTrack privilege escalation or post-exploitation activity on a cPanel server.
references:
- https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account.html
- https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/09/10
tags:
- attack.execution
- attack.privilege_escalation
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- 'cpanel'
- 'cpanellogd'
- 'exim'
- 'dovecot'
- 'mailman'
selection_child:
Image|endswith:
- '/bash'
- '/sh'
- '/dash'
- '/zsh'
- '/python'
- '/python3'
- '/perl'
- '/php'
- '/nc'
- '/ncat'
- '/socat'
User: 'root'
condition: selection_parent and selection_child
falsepositives:
- Rare; cPanel maintenance scripts may invoke interpreters but typically not interactive shells
- Verify against scheduled cPanel update windows (/scripts/upcp runs)
level: critical
---
title: Web Server Process Writing Executable Content Outside Document Roots
id: b17d3f84-2c6a-4e58-a92c-5f1e8d0b7a46
status: experimental
description: Detects Apache, LiteSpeed, or nginx worker processes writing files to system directories, which may indicate an attacker chaining a planted payload with the cPanel EmailTrack file write to achieve root execution.
references:
- https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account.html
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/10
tags:
- attack.persistence
- attack.t1505.003
- attack.defense_evasion
logsource:
category: file_event
product: linux
detection:
selection_process:
Image|contains:
- 'httpd'
- 'apache2'
- 'litespeed'
- 'lsws'
- 'nginx'
selection_path:
TargetFilename|startswith:
- '/etc/'
- '/usr/local/bin/'
- '/usr/bin/'
- '/root/'
- '/tmp/'
- '/var/tmp/'
condition: selection_process and selection_path
falsepositives:
- Web application temp file handling under /tmp and /var/tmp; tune by excluding known application temp patterns
- Log rotation and maintenance tasks
level: medium
KQL (Microsoft Sentinel)
If you ship Syslog and auditd data from your hosting fleet into Sentinel (via the Syslog/CEF connectors or the Azure Monitor Agent), the following hunts surface the exploitation artifacts. Run them against a 7–14 day lookback immediately, then convert to scheduled analytics rules.
// Hunt 1: File writes to privileged persistence locations on cPanel hosts
// Source: auditd/Syslog ingestion from Linux hosting servers
let PersistencePaths = dynamic(["/etc/cron.d/", "/etc/systemd/system/", "/etc/sudoers.d/", "/root/.ssh/", "/etc/cron.daily/", "/etc/cron.hourly/"]);
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any (PersistencePaths)
| where SyslogMessage has_any ("cron", "systemd", "sudoers", "authorized_keys", "open", "creat", "write")
| extend HostName = HostName, Message = SyslogMessage
| project TimeGenerated, Computer, HostName, Facility, SeverityLevel, ProcessName, SyslogMessage
| order by TimeGenerated desc;
// Hunt 2: Root-owned shell or interpreter execution referencing cPanel/mail context
Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("cpanel", "exim", "dovecot", "EmailTrack")
| where SyslogMessage has_any ("/bin/bash", "/bin/sh", "python", "perl", "/usr/bin/php", "uid=0")
| project TimeGenerated, Computer, ProcessName, ProcessID, SyslogMessage, SeverityLevel
| order by TimeGenerated desc;
// Hunt 3: Outbound connections from shells/interpreters on hosting servers (possible reverse shell)
// Requires DeviceNetworkEvents-equivalent Linux data via Defender for Endpoint on Linux or Sysmon for Linux
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceOS =~ "Linux"
| where InitiatingProcessFileName has_any ("bash", "sh", "python", "perl", "nc", "ncat", "socat", "php")
| where RemoteIPType == "Public"
| where InitiatingProcessAccountName in ("root", "cpanel", "mailnull", "exim")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated desc;
Velociraptor VQL
Deploy this hunt across your cPanel fleet to sweep for recently created persistence artifacts and suspicious root processes. The glob windows are deliberately tight — files created in these directories within the last 30 days on a stable production host are a small, reviewable set.
-- Hunt: cPanel EmailTrack privilege escalation artifacts
-- Sweeps persistence locations for recently created files and enumerates
-- root-owned interpreter processes with cPanel/mail parentage.
LET cron_files = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['/etc/cron.d/*', '/etc/cron.daily/*', '/etc/cron.hourly/*',
'/etc/systemd/system/*.service', '/etc/systemd/system/*.timer',
'/etc/sudoers.d/*', '/root/.ssh/authorized_keys*'])
WHERE Mtime > now() - 2592000
LET suspicious_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ 'root'
AND Name =~ '(bash|sh|dash|python|perl|php|nc|ncat|socat)$'
LET suspicious_conns = SELECT Pid, Name, RemoteAddr, RemotePort, State
FROM netstat()
WHERE RemotePort in (443, 8443, 4444, 1337, 6667)
AND Name =~ '(bash|sh|python|perl|php|nc|socat)'
SELECT 'cron_or_systemd_artifact' AS FindingType, FullPath AS Detail1,
Mtime AS Detail2, NULL AS Detail3, NULL AS Detail4
FROM cron_files
UNION ALL
SELECT 'root_interpreter_process', CommandLine, Exe, Username, CreateTime
FROM suspicious_procs
UNION ALL
SELECT 'suspicious_outbound_connection', Name, RemoteAddr, RemotePort, State
FROM suspicious_conns
Remediation
1. Patch Immediately
cPanel has released patched builds across all supported tiers. Apply the update on every cPanel/WHM server you operate — including development and staging boxes, which attackers love precisely because they are forgotten.
# Step 1: Record the current version for before/after verification
/usr/local/cpanel/cpanel -V
# Step 2: Force an immediate update to the patched release
/scripts/upcp --force
# Step 3: Verify the new version and confirm the update completed cleanly
/usr/local/cpanel/cpanel -V
tail -n 50 /var/cpanel/updatelogs/update.*.log | grep -iE 'error|fail|complete'
# Step 4: Confirm automatic updates are enabled so future security
# releases apply without manual intervention
grep -i 'CPANEL' /etc/cpupdate.conf
# Expected: CPANEL=release (or your standard tier). Avoid CPANEL=never in production.
# Step 5: Restart cPanel services to ensure patched binaries are loaded
/scripts/restartsrv_cpsrvd
/scripts/restartsrv_httpd
/scripts/restartsrv_exim
Reference the official cPanel security advisory published September 8, 2026, for the exact fixed build numbers per tier: cPanel Security Advisories and the original reporting. If your provider manages patching, demand written confirmation of the patched version and the date applied — do not assume.
2. Hunt Before You Assume Clean
Patching closes the hole; it does not evict an attacker who already walked through it. Before and after patching, audit for the artifacts this bug leaves behind:
# Audit recently created/modified files in root-level persistence locations
echo '=== cron.d ===' && ls -lat /etc/cron.d/ | head -20
echo '=== systemd units (last 30 days) ===' && find /etc/systemd/system/ -type f -mtime -30 -ls
echo '=== sudoers.d ===' && ls -lat /etc/sudoers.d/
echo '=== root SSH keys ===' && ls -la /root/.ssh/ 2>/dev/null && cat /root/.ssh/authorized_keys 2>/dev/null
echo '=== ld.so.preload (should not exist on most systems) ===' && cat /etc/ld.so.preload 2>/dev/null
# Find root-owned files modified in the last 14 days outside expected paths
find /etc /usr/local/bin /root -type f -mtime -14 -user root 2>/dev/null | sort
# Review cPanel account activity and mail-related logs for anomalies
grep -iE 'emailtrack|track' /usr/local/cpanel/logs/error_log | tail -50
grep -iE 'added|created|modified' /usr/local/cpanel/logs/access_log | tail -50
# Check for unexpected root-owned processes with interpreter parents
ps auxf | grep -E 'bash|sh |python|perl|php' | grep -v grep
# Validate cron integrity for root and all users
crontab -l -u root
for user in $(cut -f1 -d: /etc/passwd); do crontab -l -u $user 2>/dev/null | grep -v '^#' | grep . && echo " ^-- user: $user"; done
Any file you cannot attribute to a documented administrative action or package install is an incident until proven otherwise. Treat unexplained artifacts as a potential compromise and invoke your IR process — do not simply delete them and move on.
3. Harden the Blast Radius
- Restrict mail privileges where not needed. The precondition for this exploit is a mail-privileged account. Audit cPanel packages and feature lists; disable email functionality for accounts that do not require it (e.g., static-site or app-only tenants) via WHM's Feature Manager.
- Enforce MFA on all cPanel and WHM access. An authenticated account is required — raise the cost of obtaining one. Mandate two-factor authentication for end-user cPanel logins and absolutely for reseller/WHM tiers.
- Alert on new cPanel account creation. Compromised reseller accounts are used to mint fresh "clean" hosting accounts for exactly this class of attack. Alert on account creation events and validate against change tickets.
- Isolate and monitor. Ensure cPanel hosts ship auditd, Syslog, and EDR telemetry to a central platform off-box. An attacker with root will wipe local logs; your detection survives only if the telemetry left the building first.
- File integrity monitoring on persistence paths. Deploy FIM (or auditd watches) on
/etc/cron.d,/etc/systemd/system,/etc/sudoers.d, and/root/.ssh. These are low-noise, high-signal watch targets on production hosting servers. - EOL tiers: If you are running an end-of-life cPanel version, this advisory is your final warning. Migrate to a supported tier now — EOL branches will not receive this fix.
4. For Hosting Providers and MSPs
If you operate shared hosting for customers, your obligations extend further:
- Patch the entire fleet on an emergency-change basis, not the next maintenance window.
- Run the artifact hunt above across every node before declaring the campaign complete.
- Notify affected tenants if any evidence of exploitation is found — their data, not just your server, was at risk. Contractual and regulatory notification duties (state breach statutes, PCI-DSS Req. 12.10, GDPR where applicable) may be triggered.
- Review inbound abuse desk reports for the preceding 60 days; unexplained outbound spam or scanning from a node can be the first symptom of a root-level compromise.
The Bottom Line
An arbitrary file write as root, reachable by any mail-privileged hosting account, across every supported cPanel version — this is as severe as control-panel vulnerabilities get. The defensive play is straightforward and unforgiving: patch now, hunt for the artifacts, restrict the precondition privileges, and make sure your telemetry lives somewhere root can't reach.
If you lack the internal capacity to sweep a hosting fleet for compromise indicators, that is precisely the scenario Security Arsenal's incident response and managed SOC teams exist for.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.