Vulnerabilities in WordPress, cPanel, Ubuntu, and RHEL / AlmaLinux, written for whoever has to decide tonight whether it is theirs. What happened, who is affected, the exact fix, and the vendor's own advisory. Severity as scored, never as felt.
Newest first · Last updated October 6, 2026
October 1, 2026 · cPanel & WHM · A dated list
Each cPanel & WHM security fix this year with a published CVE record, from the April 29 login bypass on CISA's exploited list to the September 23 CalDAV and WP Toolkit fixes, dated by CVE record: what each fixed, its score, and its fixed builds. On 11.110.0.147, 11.134.0.59, 11.136.0.43 or 11.138.0.10 or later, your cPanel build is past every row. See the list.
September 30, 2026 · WordPress · CVSS 4.0 9.2, Critical · Exploited
An unauthenticated attacker can make WordPress include a local PHP file while resolving a page template, which can lead to code execution when the theme and server meet two conditions. Every version from 4.7 through 7.1.1 is affected. Fixed in 7.1.2, 7.0.6, 6.9.9, 6.8.10, and older branches back to 4.7.37, released September 22. On CISA's exploited list since September 25. How to check and update.
September 29, 2026 · cPanel & WHM · CVSS 4.0 9.4, Critical
A flaw in cPanel's CalDAV/CardDAV service lets any authenticated cPanel account holder run code as root. Fixed in 11.134.0.57, 11.136.0.41, 11.138.0.8, and WP Squared 11.138.1.11, released September 22. The same builds fix CVE-2026-68490, which let local users read other accounts' calendars and contacts. Updated October 1: WP Toolkit's CVE-2026-87900 (CVSS 4.0 9.4) from the same day's advisories, is fixed in WP Toolkit 6.11.3-10850, a version the cPanel build number does not show. How to check and update.
Hosted with us and unsure whether one of these touches your account? Log in and open a ticket. A system administrator will answer it, 24/7/365.