If you run a VPS or dedicated server with cPanel/WHM, stop what you're doing and read this. Security researchers have flagged a critical cPanel vulnerability that allows attackers to bypass authentication and gain root access to affected servers. Even worse, there's strong evidence it's already being exploited as a zero-day in the wild.
The good news? Patches are available, and applying them takes just a few minutes. The better news? If you're hosting with TPC Hosting on a managed plan, we've already got your back. This guide walks you through what's happening, how to check if you're vulnerable, and exactly what to do next, no jargon, no panic, just practical steps.
What's Actually Going On With This cPanel Bug?
cPanel and WHM are the control panels behind a huge chunk of the world's hosting infrastructure. They make it easy to manage websites, email, databases and DNS without touching the command line. That convenience is also why a serious flaw in cPanel is such a big deal: one vulnerability can affect millions of servers overnight.
The vulnerability in question lets unauthenticated attackers bypass login protections and escalate to root level. In plain English, that means a bad actor doesn't need your password, your two-factor code or even a valid account to potentially take full control of an unpatched server. Once they're in, they can install backdoors, steal data, deploy ransomware, or quietly use your server to attack others.
Security teams tracking the bug believe it was likely exploited as a zero-day before the patch landed, meaning some servers may already be compromised without their owners knowing. That's why patching alone isn't enough. You also need to check for signs of intrusion, which we'll cover below.
How to Check If Your Server Is Vulnerable
The first step is knowing which version of cPanel you're running. Log in to WHM as root and look in the top-right corner, or run this from the command line:
/usr/local/cpanel/cpanel -V
If you're on an older release tier and haven't updated in the last few weeks, assume you're vulnerable until proven otherwise. cPanel has issued emergency patches across its STABLE, RELEASE, CURRENT and EDGE tiers, so the exact target version depends on which channel you track. Check the official cPanel security advisory for the specific patched build numbers.
You should also look for signs of compromise. Review WHM's login history for unfamiliar root or reseller logins, check /var/log/secure and /usr/local/cpanel/logs/access_log for suspicious activity, and watch for unexpected cron jobs, new SSH keys in ~/.ssh/authorized_keys, or processes you don't recognise. If anything looks off, treat the server as compromised and rebuild from a clean backup rather than just patching over the problem.
How to Patch and Harden Your Server Right Now
Patching cPanel is refreshingly straightforward. As root, simply run:
/scripts/upcp --force
This forces an immediate cPanel update regardless of your normal schedule. The process takes a few minutes and usually doesn't require a reboot. Once it finishes, verify the new version with the command from earlier and confirm it matches the patched build cPanel has published.
While you're in there, take the opportunity to harden a few other things:
- Enable automatic updates in WHM under Update Preferences so you never fall behind again
- Force two-factor authentication for all WHM and cPanel users
- Restrict WHM access by IP via Host Access Control where practical
- Disable unused services and old reseller accounts you no longer need
- Make sure ConfigServer Firewall (CSF) or your firewall of choice is active and tuned
- Take a fresh offsite backup before and after patching
If you're on a managed VPS or dedicated server with TPC Hosting, our team has already rolled out the patch across our managed fleet and audited logs for indicators of compromise. You don't need to lift a finger, though we always recommend logging in to confirm everything looks healthy on your end.
What If You Think You've Already Been Hit?
If you spot anything suspicious, time matters. Attackers who exploited this bug as a zero-day have had a head start, and the longer a backdoor sits in place, the harder it becomes to fully evict them. Don't try to clean a compromised server in place unless you're very experienced, persistent malware and rootkits can survive surface-level cleanup.
The safer path is to spin up a fresh server, restore website files and databases from a known-clean backup (ideally one taken before the suspicious activity began), rotate every password and API key, and then point your DNS at the new server. Yes, it's a hassle. It's also the only way to be confident your environment is truly clean.
If this sounds overwhelming, reach out. The TPC Hosting support team handles incident response and clean migrations regularly, and we'd rather help you rebuild properly than watch you wrestle with a half-cleaned box for weeks.
Frequently Asked Questions
Below are the questions we've been getting most often since this vulnerability went public.
FAQ
Do I need to patch if my cPanel server is behind a firewall?
Yes. A firewall reduces exposure but doesn't eliminate it, especially if WHM ports are open to staff, resellers or remote tools. The vulnerability bypasses authentication entirely, so any path that reaches cPanel is a risk. Patch first, then tighten firewall rules as a second layer.
Will TPC Hosting patch my server automatically?
On managed VPS and dedicated plans, yes, we've already applied the emergency cPanel update and reviewed logs for signs of compromise. On unmanaged plans you control the OS and cPanel directly, so you'll need to run the update yourself. Contact support if you'd like us to handle it.
How can I tell if my server was compromised before I patched?
Check WHM login history, /var/log/secure, and cPanel access logs for unknown logins. Look for unexpected SSH keys, new cron jobs, unfamiliar processes and outbound connections to unusual IPs. If anything looks off, treat the server as compromised and rebuild from a clean backup rather than patching in place.
