Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

**cPanel critical vulnerability (CVE-2026-65643):** cPanel and WHM contain a flaw in domain parking/addon domain functionality that can allow an authenticated user who can add parked/addon domains to create arbitrary files and achieve code execution as root; patched builds for multiple branches were released and administrators are advised to update or enable automatic updates, though no published CVE record, CVSS score, or confirmed widespread exploitation was reported at the time.