TLDR Tech / InfoSec
cPanel, WHM Release Fixes for Three New Vulnerabilities — Patch Now
cPanel shipped fixes for three flaws in cPanel and WHM that allow arbitrary file read, Perl code execution via the create_user API, and unsafe chmod via symlinks (CVE-2026-29201/2/3, two rated 8.8). Patches land across multiple 11.x branches plus WP Squared, with a direct 110.0.114 build for CentOS 6 and CloudLinux 6 holdouts. No in-the-wild abuse yet, but this comes right after a separate cPanel zero-day (CVE-2026-41940) that was used to drop Mirai variants and the Sorry ransomware.
Read the full story