CVE-2026-65643: Critical cPanel/WHM Root Code Execution Flaw — Detection and Remediation Guide for Hosting Providers

---
title: cPanel/WHM Backend Process Spawning Suspicious Shell or Command Interpreter
id: 3f8c1d2e-7a4b-4c9e-b1f6-2d5e8a0c4f7b
status: experimental
description: Detects cPanel/WHM backend or web server processes spawning shells or command interpreters, consistent with exploitation of CVE-2026-65643 via domain parking/addon domain functionality resulting in root code execution.
references:
  - https://thehackernews.com/2026/08/critical-cpanel-flaw-could-let-one.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.execution
  - attack.privilege_escalation
  - attack.t1059.004
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - '/usr/local/cpanel/'
      - 'cpsrvd'
      - 'whostmgr'
      - 'cpanel'
      - 'httpd'
      - 'apache'
      - 'nginx'
  selection_child:
    CommandLine|contains:
      - '/bin/sh'
      - '/bin/bash'
      - 'perl -e'
      - 'python -c'
      - 'curl '
      - 'wget '
      - 'base64'
      - 'ncat'
      - 'nc -'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate cPanel maintenance scripts and EasyApache rebuilds (baseline and exclude known paths)
level: high
---
title: Root-Written Files in Web Document Roots or Persistence Locations Following cPanel Domain Operations
id: 8b2e4f6a-1c3d-4e5f-9a7b-6c8d0e2f4a6b
status: experimental
description: Detects creation of executable or script files in user document roots, cron directories, or systemd paths by root-owned processes shortly after cPanel parking/addon domain activity, a common post-exploitation artifact of CVE-2026-65643.
references:
  - https://thehackernews.com/2026/08/critical-cpanel-flaw-could-let-one.html
  - https://attack.mitre.org/techniques/T1053/003/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.persistence
  - attack.t1053.003
  - attack.t1505.003
  - attack.t1543.002
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/etc/cron.d/'
      - '/etc/cron.daily/'
      - '/etc/cron.hourly/'
      - '/var/spool/cron/'
      - '/etc/systemd/system/'
      - '/root/.ssh/authorized_keys'
  selection_webshell:
    TargetFilename|endswith:
      - '.php'
      - '.pl'
      - '.cgi'
      - '.py'
      - '.sh'
    TargetFilename|contains:
      - '/public_html/'
      - '/home/'
  condition: selection_paths or selection_webshell
falsepositives:
  - Administrator-deployed cron jobs and tenant-uploaded PHP applications; correlate with change windows and cPanel account activity
level: medium
---
title: Outbound Network Connection from cPanel Server Web or Backend Process to Unusual Destination
id: 5d7a9c1b-3e2f-4a8c-b6d1-9f0e2c4a6b8d
status: experimental
description: Detects outbound connections initiated by httpd/nginx/cPanel backend processes to rare external destinations, potentially indicating reverse shell or payload retrieval following CVE-2026-65643 exploitation.
references:
  - https://thehackernews.com/2026/08/critical-cpanel-flaw-could-let-one.html
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071.001
  - attack.t1105
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
      - 'httpd'
      - 'nginx'
      - 'cpsrvd'
      - 'php'
    Initiated: 'true'
  filter_update_services:
    DestinationHostname|contains:
      - 'cpanel.net'
      - 'cpanel.com'
      - 'cloudlinux.com'
  condition: selection and not filter_update_services
falsepositives:
  - Legitimate outbound HTTP from PHP applications, license checks, and WordPress update calls; baseline per server role
level: medium

// Hunt 1: cPanel backend spawning shells or downloaders (CVE-2026-65643 exploitation pattern)
Syslog
| where TimeGenerated > ago(7d)
| where Computer has_any ("cpanel", "whm", "host", "web") // tune to your fleet naming
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "perl -e", "python -c", "curl ", "wget ", "base64 -d", "nc -", "ncat")
| where SyslogMessage has_any ("cpsrvd", "whostmgr", "httpd", "cpanel", "park", "addondomain")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc;

// Hunt 2: New cron/systemd/SSH-key artifacts or web-root script writes after domain operations
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("/etc/cron.d/", "/var/spool/cron/", "systemd/system", "authorized_keys", "public_html")
| where SyslogMessage has_any ("php", ".pl", ".cgi", ".sh", "CRON", "systemd")
| where SyslogMessage !has_any ("logrotate", "sa-update", "certbot", "backup") // known-good maintenance
| summarize ArtifactHits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, ProcessName, SyslogMessage
| order by LastSeen desc;

-- Hunt cPanel post-exploitation artifacts (CVE-2026-65643)
-- Persistence: cron/systemd/SSH keys modified in the last 7 days
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  '/etc/cron.d/*',
  '/var/spool/cron/*',
  '/etc/systemd/system/*.service',
  '/root/.ssh/authorized_keys',
  '/home/*/.ssh/authorized_keys'
])
WHERE Mtime > now() - 604800

-- Root-owned shells or interpreters parented to web/cPanel processes
SELECT Pid, Ppid, Name, Exe, Cmdline, Username, CreateTime
FROM pslist()
WHERE Username =~ 'root'
  AND (Exe =~ '/(ba)?sh$' OR Cmdline =~ 'perl -e|python -c|nc |ncat|curl |wget ')

-- Recently modified scripts in tenant document roots (potential web shells)
SELECT FullPath, Size, Mtime
FROM glob(globs='/home/*/public_html/**/*.php')
WHERE Mtime > now() - 604800
  AND Size < 50000

#!/bin/bash
# CVE-2026-65643 cPanel/WHM verification and triage script
# Usage: bash cpanel_cve_2026_65643_check.sh [--update]

set -u
echo "=== cPanel/WHM Version Check ==="
if [ -f /usr/local/cpanel/version ]; then
    CPVER=$(cat /usr/local/cpanel/version)
    echo "Installed cPanel version: ${CPVER}"
else
    echo "[!] cPanel version file not found — is this a cPanel server?"
    exit 1
fi

# Consult the official cPanel advisory for the fixed build per tier (11.x LTS/Current).
# If your build predates the advisory's fixed versions, update immediately.
if [ "${1:-}" = "--update" ]; then
    echo "=== Forcing cPanel update via upcp ==="
    /scripts/upcp --force
    echo "=== Post-update version ==="
    cat /usr/local/cpanel/version
    /usr/local/cpanel/cpanel -V 2>/dev/null || true
fi

echo ""
echo "=== Triage: Recent cron/systemd persistence (last 7 days) ==="
find /etc/cron.d /var/spool/cron /etc/systemd/system -type f -mtime -7 2>/dev/null | while read -r f; do
    echo "[MODIFIED] $f ($(stat -c '%y' "$f" 2>/dev/null | cut -d. -f1))"
done

echo ""
echo "=== Triage: Recently modified SSH authorized_keys ==="
find /root/.ssh /home/*/.ssh -name authorized_keys -mtime -14 2>/dev/null -exec ls -la {} \;

echo ""
echo "=== Triage: Root-owned shells parented to web/cPanel processes ==="
ps auxf | grep -E "(httpd|nginx|cpsrvd|php).*\|.*(sh|bash|perl|python)" | grep -v grep || echo "None found (review manually with: ps auxf)"

echo ""
echo "=== Triage: Suspicious root-owned processes spawned recently ==="
ps -eo user,pid,ppid,lstart,cmd | grep -E "^root" | grep -E "(curl|wget|nc |ncat|base64|/tmp/|/dev/shm/)" | grep -v grep || echo "None found"

echo ""
echo "=== Triage: Executable files in /tmp and /dev/shm ==="
find /tmp /dev/shm -type f -perm /111 -mtime -7 2>/dev/null -exec ls -la {} \;

echo ""
echo "=== Triage: Recently modified PHP in document roots (potential web shells, last 3 days) ==="
find /home/*/public_html -maxdepth 4 -name "*.php" -mtime -3 2>/dev/null | head -50

echo ""
echo "=== Review cPanel logs for anomalous park/addon domain activity ==="
echo "Check: /usr/local/cpanel/logs/access_log and /usr/local/cpanel/logs/error_log"
grep -hiE "park|addondomain" /usr/local/cpanel/logs/access_log 2>/dev/null | tail -30

echo ""
echo "=== Done. Cross-reference findings with cPanel advisory and your EDR/SIEM. ==="