CTI · corroborated · 2026-08-28

Critical cPanel Vulnerability Allows Attackers to Gain Full Root Control of Servers

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1068 Exploitation for Privilege Escalation Privilege Escalation

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: cPanel Domain Parking Privilege Escalation Attempt (CVE-2026-65643)
id: d6f0a3b5-8b4e-4d9c-be7f-3e5b0d2c4f6a
status: experimental
description: Detects potential exploitation of cPanel CVE-2026-65643 where an authenticated user with domain parking permissions can escalate to root-level code execution. Monitor for anomalous file creation in cPanel domain parking directories and unexpected root shell spawning from cPanel processes.
references:
  - https://gbhackers.com/cpanel-cve-2026-65643-root-vulnerability
  - https://cyberpress.org/cpanel-critical-vulnerability-root-control
author: Tia N. List
date: 2026-08-28
tags:
  - attack.t1190
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_file_create:
    EventID: 1
    TargetFilename|contains:
      - '/usr/local/apache/conf/'
      - '/home/'
      - '/var/cpanel/'
    TargetFilename|endswith:
      - '.conf'
      - '.php'
      - '.cgi'
  selection_root_from_cpanel:
    EventID: 1
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/perl'
      - '/php'
    User: 'root'
    ParentImage|contains:
      - 'cpanel'
      - 'cpsrvd'
      - 'tailwatchd'
      - 'queueprocd'
  condition: selection_file_create or selection_root_from_cpanel
falsepositives:
  - Legitimate cPanel domain parking configuration
  - Standard cPanel administrative operations
level: critical

References

• https://gbhackers.com/cpanel-cve-2026-65643-root-vulnerability
• https://cyberpress.org/cpanel-critical-vulnerability-root-control