What Hosting Administrators Need to Know A Linux server can run websites smoothly and still have a serious flaw in its operating system. That’s why hosting providers need to pay attention to kernel vulnerabilities, even when their applications and customer accounts appear to work normally. One recent example is ZDI-CAN-33367, a Linux kernel vulnerability that allows a local, unprivileged user to change file contents stored in memory under specific conditions. The affected file may belong to another user or even root, although the attacker normally can read it but not modify it. The vulnerability can create a serious problem for hosting providers that run multiple customer accounts on the same server. If an attacker gains local access, they may use …
Server Security
Picture an apartment building. The building is your server. Each apartment is a virtual machine (VM) that you rent to a customer. Most tenants are lovely. A few are curious. And once in a while, one of them finds a way to walk through the wall into the building’s control room. That is the kind of problem CVE-2026-99999 creates. Researchers call it PwnEscape. It is a flaw in the Linux kernel, in the part that handles virtio-net and TAP networking. AWS published a bulletin about it (2026-137-AWS) on October 15, 2026, and advice from different vendors keeps changing as new details emerge. This checklist is for VPS providers, data centers, and businesses that run their own KVM hosts. By the …
CVE-2026-65643: cPanel Domain Parking Vulnerability and Security Patch Guide
A newly disclosed cPanel security vulnerability deserves immediate attention from anyone operating a cPanel-based hosting environment.CVE-2026-65643 affects cPanel & WHM’s domain parking functionality. According to cPanel’s August 27, 2026 security advisory, an authenticated cPanel account holder who is permitted to add parked or addon domains can create arbitrary files on the server. Successful exploitation can ultimately result in code execution as the root user, potentially giving an attacker control over the server and the accounts, websites, and databases running on it.
GhostLock (CVE-2026-43499): How to Protect Your Linux Servers from the Latest Kernel Vulnerability
Cybersecurity threats targeting Linux servers continue to evolve, and GhostLock (CVE-2026-43499) is one of the most significant Linux kernel vulnerabilities administrators should address immediately. This vulnerability affects the Linux kernel and allows a local attacker with standard user privileges to escalate access to the kernel. In containerised environments, the impact is even greater, as attackers may be able to escape container isolation and gain control of the underlying host operating system. Organisations running web hosting servers, VPS, cloud infrastructure, dedicated servers, Kubernetes clusters, Docker containers, or shared hosting platforms should prioritise patching this vulnerability to reduce the risk of compromise. At SupportPRO, we strongly recommend updating vulnerable Linux systems as soon as vendor security patches become available.
In a hosting environment, you often have to automate things. Whether you’re provisioning accounts, managing backups, integrating billing systems or monitoring server performance, the WHM API makes these tasks faster and more efficient. But with this convenience comes responsibility. The WHM API provides administrative access to core server functions. If such access is left unsecured, attackers may create accounts, change configurations, access sensitive data, or disrupt services. One exposed credential can lead to severe security incidents. This blog will explain WHM API authentication, how to secure API tokens, how to implement IP restrictions, and security best practices to maintain a secure server environment. Understanding WHM API Authentication In the past, many administrators simply used usernames and passwords for authenticating API …
2026 hasn’t been kind to cPanel environments so far. A few serious vulnerabilities have already forced hosting providers to patch quickly, and in some cases, restrict access to WHM entirely until fixes were applied. Since cPanel & WHM is used on a massive number of shared hosting servers, even a single exploit ends up being a widespread problem pretty fast. CVE-2026-41940 — the one everyone kept talking about The main issue that stood out this year was CVE-2026-41940. It’s an authentication bypass in cPanel & WHM. In simple terms, it meant attackers could potentially reach cPanel or WHM without having valid login credentials in some cases. That alone is enough to make it critical, especially because WHM gives full server-level …
The internet depends heavily on web servers and reverse proxies to deliver websites, APIs, and cloud applications securely and efficiently. One of the most widely used technologies in this space is NGINX, trusted by enterprises, startups, cloud providers, and DevOps teams worldwide. In May 2026, cybersecurity researchers disclosed a critical vulnerability named NGINX Rift, tracked as CVE-2026-42945. What makes this discovery especially alarming is that the flaw reportedly remained hidden inside the NGINX codebase for nearly 18 years before being identified. The vulnerability affects the ngx_http_rewrite_module and can potentially allow attackers to crash services or execute malicious code remotely under specific conditions. Because NGINX powers a significant portion of internet-facing infrastructure, the vulnerability immediately attracted attention from security teams, cloud …
Dirty Frag: Universal Linux LPE
Dirty Frag is a vulnerability in Linux that allows an attacker to gain higher access or permissions than they are normally allowed on the system This vulnerability was disclosed earlier than planned due to an embargo break, which means information about the vulnerability was released publicly before the agreed-upon disclosure date. It’s a part of Linux kernel page cache exploits — following Dirty Pipe (2022) and Copy Fail (earlier this year). What are Linux kernel page cache exploits? The page cache in Linux is a system memory area where frequently accessed file data is temporarily stored. It speeds up file operations because reading from memory is faster than reading from disk. However, if an attacker can manipulate the page cache …
7 Critical Actions for Every cPanel & WHM Server Owner to Take Following the Security Update 04/28/2026
The recent cPanel & WHM Security Update 04/28/2026 has stirred up quite a bit of commotion in the web hosting and infrastructure communities. According to cPanel & WHM, vulnerabilities in authentication paths affect all supported versions. For companies operating their own servers, it is crucial to act promptly as this situation poses severe risks to server security and potentially leads to service outages. April 2026 Security Update Overview The current issue lies in the authentication mechanisms, which are responsible for accessing server resources. By exploiting these vulnerabilities, attackers may attempt to: It impacts: Why This Issue is Important It is essential to understand that this update relates to a significant security risk and not just a technical one. Primary Concerns …
In today’s hosting landscape, security threats evolve faster than most teams can keep up with. Malware authors constantly refine their techniques, exploit new vulnerabilities, and look for any weak point in a server’s configuration. For hosting companies, server admins, and developers who prioritize security, the real difficulty isn’t simply finding threats – it’s ensuring detection happens reliably, quickly, and without depending on manual effort. That’s where CPGuard’s Command Line Interface (CLI) becomes a powerful ally. CPGuard has long been known as a robust security suite for cPanel servers, offering malware scanning, file monitoring, exploit detection, and a range of protective features. But the CLI component is often overlooked, even though it unlocks some of the most valuable automation capabilities. When …