WARNING: Multiple critical vulnerabilities in cPanel WHM and ConfigServer security & firewall (CSF) can be exploited to achieve Root-level remote code execution. Patch immediately!

**Summary:** The Centre for Cybersecurity Belgium reports three high-severity vulnerabilities: CVE-2026-67401 (cPanel WHM EmailTrack SQL injection enabling authenticated users with mail privileges to create files and achieve root code execution) and CVE-2026-65638 / CVE-2026-65639 (CSF command injection issues in the MESSENGER service and advanced-rule parser that can allow remote command execution under certain configurations). All affected products should be promptly updated to patched versions (CSF 16.30+ and appropriate cPanel updates) and organizations are advised to enhance monitoring and incident response, since exploitation can lead to full system compromise and loss of confidentiality, integrity, and availability.