cPanel Security Patch Released September 29, 2026: Severity Up to Critical

cPanel released a cPanel security patch on Tuesday, September 29, 2026, addressing multiple vulnerabilities across cPanel & WHM (Web Host Manager) with severity rated up to Critical. The patch covers cPanel & WHM versions 110 and later. cPanel reported no known exploits or proof-of-concept code in the wild before release.

InMotion Hosting will begin rolling out the cPanel security patch to Shared, Reseller, and WordPress Hosting servers shortly, so customers on those plans do not need to take any action. Customers with root access on a VPS or Dedicated server should update now.

What We Know About the cPanel Security Patch

According to cPanel, outside security researchers responsibly disclosed some of the vulnerabilities being patched, while cPanel’s own security team found others internally. cPanel has not yet published Common Vulnerabilities and Exposures (CVE) identifiers or technical details for this release. Its changelogs list each patched build as a “Targeted Security Release.” cPanel distributes the patch through its standard automatic update process and its manual update process. It strongly recommends a manual update.

The patch affects cPanel & WHM versions 110 and later. cPanel published these patched builds on September 29, 2026:

You can confirm each build in the official cPanel & WHM changelogs. If your server runs a version in the affected range that is not listed, move it to a supported release tier and update.

Note: This patch is separate from the targeted cPanel security release from September 22, 2026, which InMotion Hosting began applying that day. InMotion Hosting will update this article with CVE identifiers and a link to cPanel’s official advisory once cPanel publishes them.

What This Means for Your Hosting

Shared, Reseller, and WordPress Hosting

These plans run on InMotion Hosting’s cPanel Long Term Support (LTS) tier. InMotion Hosting manages cPanel updates on these servers, so you do not need to do anything. InMotion Hosting will begin applying the patched LTS build, 134.0.61, shortly. The rollout reaches servers in stages, so your account may update at a different time than others.

VPS and Dedicated servers

InMotion Hosting does not push this patch to VPS or Dedicated servers. Most InMotion Hosting VPS and Dedicated servers follow cPanel’s RELEASE tier, not LTS, and receive updates through the nightly upcp cron job by default. If you have not disabled or pinned updates, your server will pick up the new build on its next scheduled update.

If you have root or WHM access and manage your own update settings, run a manual update now. Do not wait for the next scheduled cron run.

If you have a Managed VPS or Managed Dedicated server, our Technical Support and Advanced Product Support teams can review your update configuration and apply the patch for you. Reach out through your Account Management Panel (AMP) to request help.

What You Should Do

If you manage your own VPS or Dedicated server, check your current cPanel & WHM version first. Log in over Secure Shell (SSH) or open WHM’s Terminal interface as root, then run:

/usr/local/cpanel/cpanel -V

If the build number is lower than the patched build for your version in the table above, run the following command as root to update:

/scripts/upcp

Run /usr/local/cpanel/cpanel -V again afterward to confirm the build number changed.

Important: /scripts/upcp installs the most recent build available on your server’s configured release tier. If the CPANEL= line in /etc/cpupdate.conf is pinned to a specific build number, or to a version below 110, check with cPanel or our Technical Support team before updating. cPanel strongly recommends a cPanel-provided release tier (LTS, STABLE, RELEASE, CURRENT, or EDGE) instead of a fixed build number, because custom version numbers often become out of date.

What Comes Next

cPanel has not yet published CVE identifiers or a full advisory for this release. InMotion Hosting will update this article with the CVE identifiers and a link to cPanel’s official advisory once cPanel publishes them. In the meantime, you can track build numbers on the official cPanel & WHM changelogs.