Security Digest – November 2026

The past couple of months have been unusually busy on the security front. Serious vulnerabilities were disclosed in PHP, LiteSpeed Web Server and the Linux kernel, several with public exploits. Every one of them has been patched across all of our servers, and nothing further is required on your end. Below is a high-level rundown of what was fixed and what we did about it.

Critical PHP Vulnerabilities (php2shell)

All PHP versions we offer are fully patched against CVE-2026-109618 and CVE-2026-109619, the pair of PHP engine flaws nicknamed php2shell. Both are rated 9.2 (CVSS v4.0) and can let an attacker run code on a server without logging in. They have since been exploited in the wild, which made speed critical.

Date What we did
October 20 Began monitoring as soon as the flaws were announced, and put interim mitigations in place through php.ini and Imunify360.
October 21 Updated every server the moment CloudLinux published patched alt-php packages. CloudLinux backported the fixes into the existing versions, so version numbers did not change at first.
October 22 Installed CloudLinux’s re-released alt-php packages, versioned to match PHP’s official fixes (8.2.35, 8.3.36, 8.4.27, 8.5.12). The code is identical to the earlier patched builds; only the reported version number changed.

PHP 5.6 through 8.1 are no longer maintained by PHP directly, but they remain secured with CloudLinux’s backported patch. That said, if your site still runs one of these older versions, now is a great time to move to PHP 8.2 or newer. Continue reading →

Security Digest – July 9

We patched a few things on our servers this week — including three serious Linux kernel bugs and a cPanel fix. Here’s the quick version of what happened and why it mattered.

The Kernel Bugs

GhostLock (CVE-2026-43499) — Disclosed July 7, this one let any local process jump straight to root by exploiting a flaw in how the kernel handles futex locks. Working exploit code was public within hours, and researchers say it got a root shell in about 5 seconds. On a shared server, that’s scary — it means a single hacked WordPress plugin could turn into a fully owned box.

Januscape (CVE-2026-53359) — A 16-year-old bug in KVM (the tech behind virtual machines) that let a VM “escape” and mess with the host it’s running on. If you run anything virtualized, this is the kind of bug that breaks the wall between tenants — which is the whole point of virtualization.

Bad Epoll (CVE-2026-46242) — Disclosed July 1, this is a race-condition bug in epoll, the thing basically every web server (nginx, Apache, Node, you name it) uses to juggle connections. Any local user could exploit it to become root. Can’t be turned off, so patching was the only real fix.

All three are now patched across our infrastructure.

The cPanel Fix

We also updated cPanel & WHM to build 11.134.0.44, which patches a File Manager bug (cPanel’s writeup here). Basically, File Manager was letting users follow symlinks to files they shouldn’t be able to see — stuff they’d be blocked from over SSH, sometimes including other users’ home directories depending on permissions. That’s fixed now.

As always, please do not hesitate to reach out if you have any questions or concerns.

Security Digest – May 25

A targeted security release from cPanel was scheduled to be released on Wednesday (5/20) but was pushed out around 12 hours early due to a critical privilege escalation vulnerability that was discovered in the LiteSpeed cPanel plugin. We had already been made aware of this and uninstalled the plugin in question immediately. It remains uninstalled on all of our servers as a precaution since it is not necessary and rarely used. There were two separate updates to this plugin over a short period, both addressing critical vulnerabilities. Details of the patched cPanel vulnerabilities are not public at this time.

A second cPanel update was released just a day later (5/21) to address vulnerabilities patched in Unbound. Nginx related updates were also made available but do not impact us. We’ll continue to stay on top of these for you.

Security Digest – May 18

The past several weeks have brought a whirlwind of new security vulnerabilities, many of them critical in nature. While we’ve been posting updates to the notification section within our portal, we wanted to begin posting these here given how frequent they’re likely to continue given recent AI developments. If you would like to stay up-to-date on these, you can subscribe to our blog to receive email notifications for any updates. For the most part, though, these have little impact to clients other than an occasional server reboot to get updates fully applied.

cPanel / WHM Authentication Bypass Vulnerability (CVE-2026-41940)

This recent wave was kicked off by the most severe of the vulnerabilities thus far, an authentication bypass vulnerability within cPanel / WHM  scoring a 9.8 out of 10.

Our advanced and extensive monitoring of all servers that we manage helped us to detect and address this well before this vulnerability was public. We first encountered this in the wild on April 8 and confirmed its presence on April 20. We immediately reported this to cPanel and disabled public WHM access to our servers at that time.

cPanel finally released updates to address this vulnerability nine days later, on April 29. We installed these updates as quickly as we could and lifted the WHM access restrictions. Afterwards, it only took a few hours of this being public before we began seeing extensive attempts to exploit this vulnerability. This highlights the necessity in patching these vulnerabilities quickly. Continue reading →

Behind the Scenes: Infrastructure Updates

It has been a little quiet here on our blog lately, but rest assured — we’ve been anything but idle behind the scenes. We wanted to take a moment to share a quick update on what’s been happening and some of the improvements we’ve made over the past several months.

Network & Infrastructure Updates

Last month, we completed a migration of our offsite DNS cluster. This change was part of a larger effort to strengthen the reliability and performance of our overall hosting environment.

Additionally, several other services — including our website, client portal, monitoring system, and offsite backups — have also been relocated. Previously, both our primary hosting location in Dallas and our offsite services in Atlanta shared the same upstream provider. To improve network diversity and resilience, we’ve moved our offsite services from Atlanta to a new upstream provider in Chicago.

This change helps further distribute our infrastructure across multiple providers and regions.

Software & Platform Maintenance

As always, keeping systems current and secure remains an ongoing priority. Our team continues to test and deploy software updates across our hosting platform.

While cPanel updates have slowed a bit this year, there have still been a couple noteworthy changes. This includes the addition of a temporary domain functionality and the removal of PHP Composer from the default installation (we now maintain our own instance).

Looking ahead, we’re keeping a close eye on the upcoming cPanel 132 release, which will introduce Dovecot 2.4. We’ll be monitoring this transition carefully to ensure a smooth experience for all customers.

Continuing to Improve

We’re committed to providing a hosting platform that’s both stable and forward-looking. These updates are part of our ongoing effort to improve performance, security, and network diversity — all while maintaining the high level of reliability our clients expect.

As always, we appreciate your continued trust and support.

PHP 8.4 Now Available

We’re pleased to announce that PHP 8.4 is now available on all of our servers. You can easily change the PHP version per cPanel account via the “Select PHP Version” section in cPanel.

PHP 8.4 comes with numerous improvements and new features such as:

The full change log for version 8.4 can be found on PHP’s website here and the migration guide is also available. Please consult these for a detailed list of new features and backward incompatible changes. For third party applications, it’s best to confirm that they support PHP 8.4 before making the switch. However, if you run into any issues you can quickly and easily revert back to your prior version.

Please note that only a limited number of extensions are currently available for PHP 8.4. We will continue to make new ones available as soon as they are offered. We now offer secure versions of PHP 5.6 through 8.4 which are all easily selectable from within cPanel. Version 8.2 is now the default for all new cPanel accounts while existing accounts will continue to retain their prior settings.

cPanel Teams – Enabling Multi-User cPanel Access

A frequent question from clients over the past 20 years has been “How do I grant someone else access to my cPanel?” and up until recently there hasn’t been a solution other than providing the individual with the cPanel account’s login information. This is where cPanel’s relatively new Manage Team feature steps in and allows you to create team users within cPanel, granting them a selection of privileges to the cPanel account.

To get started, you’ll first need to create a feature list within WHM with the “Manage Team” feature enabled. To avoid confusion for clients that don’t require this functionality, we do not enable it by default. You can then edit your packages to use this feature list where necessary. After this is completed, you’ll notice that the left menu of cPanel now has a “Manage Team” link.

Upon selecting the “Manage Team” menu item, you’ll be presented with a list of your current team users along with options to create users and view the audit log. As you can see below, this demo account has one user present with the “Database” role selected. You can also see when the user was created and when they most recently logged in. Continue reading →

Server Upgrades Completed, CPU & RAM Limits Increased

Over the past several months, we have been diligently working to upgrade all of our hosting servers and we’re happy to report that these have all been completed. These upgrades bring significant hardware and software upgrades to every client, details of which can be found in our previous blog post.

The servers themselves received significant increases in RAM, processing power and storage performance. Most notably, all client data is now stored exclusively on new NVMe storage arrays which are already proving to be very beneficial.

With these additional hardware resources now available, we’re excited to announce that CPU and RAM limits have been doubled for all cPanel accounts. This means that instead of cPanel LVE limits being set to 1 CPU core and 1GB of RAM, these are now set to 2 CPU cores and 2GB of RAM. While the majority of accounts don’t come close to needing these additional resources, we’ve seen the positive impact this has had on some busier sites dealing with traffic spikes and abusive bots.

We hope you find these upgrades to be helpful and, as always, please don’t hesitate to reach out to us if we can be of any assistance!

Upcoming Changes: PHP 5.4, 5.5 Removal & MariaDB 10.6

Over the next few months, we will once again be revamping all of our hosting servers. We’re excited to deploy hardware upgrades across the board, including additional processing cores and RAM as well as NVMe SSD storage arrays. One of our goals has always been to provide the best performance possible and these upgrades will enable us to continue doing so.

We’ll also be making the switch from CloudLinux 7, which will reach end of life soon, to CloudLinux 9. This will make for some meaningful upgrades to a lot of core system software and libraries such as OpenSSL. We’ve been eagerly awaiting cPanel’s official support of CloudLinux 9 to move forward and have already deployed it and AlmaLinux 9 across all of our internal systems with great success. While the operating system upgrade doesn’t have a significant impact to hosted accounts, there are a couple of related changes that you should be aware of.

 

PHP 5.4 & 5.5 Removal

CloudLinux 9 no longer supports PHP 5.4 and PHP 5.5 so these will no longer be available for you to use. All accounts still using these very old versions will be switched to PHP 5.6 before servers are upgraded. We encourage you to use PHP 8.1 or newer wherever possible. As always, you can continue to select your desired PHP version via the “Select PHP Version” section of cPanel.

MariaDB 10.6

Replacing servers also provides us with a great opportunity to upgrade the database server software; so MariaDB will be upgraded from 10.5 to 10.6. For most users, this will not be a noticeable change unless you’re planning to use new functionality that the upgrade will provide. Please make sure that your scripts are kept updated as usual and you won’t run into any issues.

 

All clients can expect to receive a notification with further details as soon as their server’s upgrade is scheduled. If you have any questions meanwhile, please submit a ticket and we’ll be happy to answer them.

PHP 8.3 Now Available

We’re pleased to announce that PHP 8.3 is now available on all of our servers. You can easily change the PHP version per cPanel account via the “Select PHP Version” option in cPanel.

PHP 8.3 comes with numerous improvements and new features such as:

The full change log for version 8.3 can be found on PHP’s website here and the migration guide is also available. Please consult these for a detailed list of new features and backward incompatible changes. For third party applications, it’s best to confirm that they support PHP 8.3 before making the switch. However, if you run into any issues you can quickly and easily revert back to your prior version.

Please note that only a limited number of extensions are currently available for PHP 8.3. We will continue to make new ones available as soon as they are offered. We now offer secure versions of PHP 5.4 through 8.3 which are all easily selectable from within cPanel. Version 8.1 is now the default for all new cPanel accounts while existing accounts will continue to retain their prior settings.