‼️ ALERT: A new cPanel flaw, CVE-2026-87899, in CalDAV/CardDAV lets any logged-in cPanel account run code as…
SAHLA Y. — Network / Web applications tester
‼️ ALERT: A new cPanel flaw, CVE-2026-87899, in CalDAV/CardDAV lets any logged-in cPanel account run code as root and take full control of the server.
A second flaw, CVE-2026-87900 in WP Toolkit, lets authenticated users modify databases belonging to other accounts.
🔗 Learn more → https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account_0272795595.html
#cybersecurity #ethicalhacking #news #hackernews #offsec
4 reactions · 1 comments
Topics: #news, #ethicalhacking, #offsec, #hackernews, #cybersecurity
Comments
Schomer: Excellent alert, Sahla. This cPanel/WP Toolkit exposure highlights a massive structural pattern we see constantly: an absolute failure of privilege containment when processing user-authenticated sessions across localized service handlers. When a localized hosting plugin or service allows an account holder to escalate straight to a root context or alter cross-tenant databases, it means the applicat