We are performing essential maintenance and security upgrades
to enhance system stability and protect against emerging AI threats like Mythos AI as per Government Advisory.
Further as per following advisory
cPanel (CVE-2026-41940)(CVSS score: 9.8)
(https://nvd.nist.gov/vuln/detail/CVE-2026-41940) and
CloudLinux systems (CVE-2026-31431)(CVSS score: 7.8)
(https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/).
Wordpress, Joomla, apache, softaculous apps, mysql based websites will be effected by it.
React, Next.js, Vue.js, Svelte, AMP, WAF, Nuxt based websites will not be effected by this.
Premium eMail, managed wordpress and 3rd party client end email services will not be distrupted by this process.
As cPanel Inc which is existing since 1997 is getting severe Ai based vulnerabilities thus we are deploying latest servers with DirectAdmin Panels with better features and offers. Clients will have option to choose cPanel or DirectAdmin Panel going forward while cPanels will cost more in long run.
As per article on shared vulnerabilities. The issue comes from cookies of effected regular client user system which do not have proper security. Thus we would recommend all clients with admin access to update their devices security with appropriate tools like firewal, activirus, malware protection system. The time line of vulnerabilities shows its an client-side cookie injection issue rather than server one.
cPanel released patches for three additional vulnerabilities in one update:
de
CVE-2026-29201: Arbitrary file read in the LOADFEATUREFILE adminbin call.
CVE-2026-29202(CVSS score: 8.8) : Perl code injection in the create_user API call.
CVE-2026-29203(CVSS score: 8.8) : Unsafe symlink handling allowing chmod on arbitrary files
These rare and critical vulnerabilities have been listed in CISA catalog too.
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Patching servers with New Updates.
WHM/cPanel/webmail, remains disabled for now for security reasons. cPanel remains turned off till we complete taking a full backup to prevent any future AI vulnerabilities.