Shared Hosting Security in 2026: Three Server Flaws in Ten Days
Affiliate disclosure: some links on this page are affiliate links. If you sign up through one, we may earn a commission at no extra cost to you. It never changes which hosts we recommend or what we say about them.
Between September 8 and September 16, 2026, three separate security problems landed in the software stack that runs most cheap shared hosting accounts. Not WordPress plugins this time. The control panel, the web server, and the backup tool — the parts of the machine you rent but do not administer.
If you run a blog on a $3-a-month plan, that distinction matters more than it sounds. Shared hosting security is a split responsibility: you patch WordPress, your host patches everything underneath it. All three of these flaws sit squarely on your host’s side of the line, and all three end in the same place — one account on a shared server getting root.
Here is what actually happened, what it means for a normal blog, and the four things worth your time this week. Nothing here requires you to panic or migrate.
What happened, in ten days
September 8: cPanel patched a root-level flaw in EmailTrack
cPanel shipped patched builds on September 8 for CVE-2026-67401, an SQL injection in its EmailTrack component. The short version: a hosting account that already has mail privileges can use it to write files of its choosing on the server and run code as root.
Every supported version of cPanel and WHM was affected, across the 11.110, 11.134, 11.136 and 11.138 release lines. The patched builds are 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 and WP Squared 11.138.1.9.
One honest caveat, because it matters: cPanel’s advisory carried no severity score of its own, and as of September 9 there was no public exploit code and no report of the flaw being exploited. Some third-party vulnerability trackers have since attached a 9.9 rating to it. We are citing the vendor advisory and the reporting on it, not the aggregators.
September 14: LiteSpeed Enterprise told hosts to get to 6.3.7
Six days later, a security advisory went out for LiteSpeed Web Server Enterprise. A low-privilege website user on a shared-hosting server could gain root on that server — and the flaw can bypass isolation controls including CageFS, which is the specific thing shared hosts rely on to keep accounts apart.
Version 6.3.7 shipped on September 11 and is the floor. There was no CVE assigned as of September 15, and neither cPanel nor LiteSpeed has confirmed whether it has been exploited — the status is genuinely unknown, not “no.” This is also the third privilege-escalation issue in LiteSpeed software on cPanel servers since May 2026, and the first in the web server itself rather than the cPanel plugin.
LiteSpeed is not a niche product. It is the web server behind a large share of budget WordPress hosting, usually sold to you as “LiteSpeed Cache makes your site fast.”
September 16: an Acronis backup plugin flaw hit CISA’s exploited list
The third one is the only confirmed-exploited item of the three. CVE-2026-87886 is a Linux local privilege escalation in the Acronis Backup plugin for cPanel & WHM, caused by insecure file permissions, rated CVSS 7.8. Acronis confirmed exploitation “in the wild in limited, targeted attacks.”
Affected builds are earlier than 1.9.3.1021 for the cPanel & WHM plugin and earlier than 1.8.11.638 for the Plesk extension. Fixes are 1.9.3 HF3 and build 1.8.11.638 respectively.
On September 16, CISA added it to the Known Exploited Vulnerabilities catalog and gave US federal civilian agencies until September 19 to patch. A three-day deadline is CISA’s way of saying this is not theoretical.
The pattern: three different products, one destination
| Date | Component | Identifier | What it gives an attacker | Fixed in | Exploited? |
|---|---|---|---|---|---|
| Sep 8, 2026 | cPanel & WHM (EmailTrack) | CVE-2026-67401 | Mail-privileged account writes files and runs code as root | 11.110.0.143, 11.134.0.55, 11.136.0.39, 11.138.0.4 | None reported as of Sep 9 |
| Sep 14, 2026 | LiteSpeed Web Server Enterprise | No CVE assigned | Low-privilege site user reaches root, can bypass CageFS | 6.3.7 (released Sep 11) | Status unknown |
| Sep 16, 2026 | Acronis Backup plugin for cPanel & WHM | CVE-2026-87886 (CVSS 7.8) | Authenticated local attacker escalates to root | 1.9.3 HF3 (builds below 1.9.3.1021 affected) | Yes — limited, targeted attacks |
Read down the fourth column. Every one of these is a privilege escalation that ends at root on a machine you share with other people’s websites. On a shared server, root means every account on the box — including yours, even if your WordPress install is spotless.
That is the uncomfortable thing about shared hosting security. Your site’s safety is partly a function of the worst-maintained site on the same server, and entirely a function of how fast your host applies patches. You cannot audit either one from the inside.
What you can actually do this week
You cannot patch any of the three. Genuinely — there is no button in your dashboard for this. What you can do is reduce what an attacker gets if your host is slow, and find out whether your host is slow.
1. Ask your host directly, in writing
Open a ticket. Paste this in:
Can you confirm which cPanel build my server is running, whether it is at or above 11.138.0.4 (or the patched build for its release line for CVE-2026-67401), whether LiteSpeed Enterprise is at 6.3.7 or later, and whether the Acronis Backup plugin — if installed — is at 1.9.3 HF3 or later for CVE-2026-87886?
You are not being difficult. You are asking for three version numbers. What you learn from the answer is worth more than the answer itself: a host that replies within a day with specific builds is a different business from one that sends you a paragraph about taking security seriously.
2. Get one backup off the server
There is a particular irony in a backup plugin being the exploited one. If the only copy of your blog lives on the same machine as the flaw, you do not have a backup — you have a second file on a compromised server.
Pull a full export down to your own drive or to storage your host does not control. Once. Today. Then set whatever automated off-site backup your plugin or host offers and verify it actually produces a restorable file, which is the step almost everyone skips.
3. Delete the mail accounts and add-on domains you forgot about
The cPanel flaw needs an authenticated account with mail privileges. Most blogs accumulate two or three old mailboxes nobody reads and a parked domain from a project that died in 2023. Each one is a credential that can be stuffed, phished or reused. Removing them costs nothing and shrinks the set of accounts that could be the starting point.
4. Turn on two-factor authentication on the hosting panel, not just WordPress
Plenty of bloggers have 2FA on wp-admin and nothing on the cPanel login that can reset the database. Both cPanel and every host we review offer it. It takes four minutes.
If you want the longer version of the hardening checklist, we keep one in our WordPress security guide for bloggers, and the plugin-level flaws from earlier this month are covered in our September 2026 WordPress plugin security roundup.
Who should NOT change hosts over this
Almost everyone reading this. We would rather say that plainly than sell you a migration.
Three arguments against treating this as a reason to move:
- Patching happened. cPanel, LiteSpeed and Acronis all shipped fixes, in two cases before or within days of public disclosure. That is the system working, not failing.
- The stack is shared across hosts. cPanel and LiteSpeed are not one company’s problem. Moving from one cPanel host to another cPanel host moves you to the same three advisories.
- Migrations have their own risk. A rushed move breaks redirects, loses email, and drops rankings. We have watched people cause themselves more damage in a weekend migration than any of these CVEs did.
The honest tradeoff: if your host answers the ticket above with specific build numbers within 24 hours, you have learned something good and you should stay. If they cannot tell you what version their own control panel runs, that is a real signal — but act on it at renewal, calmly, not on a Tuesday night.
What “faster patching” actually costs
If you are shopping anyway, the thing you are buying at each price point is roughly this:
| Hosting type | Who patches the OS, panel and web server | Your exposure to neighbors | Typical blogger cost |
|---|---|---|---|
| Budget shared (cPanel) | Host, on its own schedule | High — same kernel, same panel, hundreds of accounts | $3–$10/mo |
| Premium shared / managed WordPress | Host, usually with published maintenance windows | Moderate — containerized, fewer accounts per machine | $15–$30/mo |
| Managed cloud (no cPanel) | Host, and the stack has no cPanel to patch | Low — isolated containers per site | $30–$115/mo |
| Self-managed VPS | You | None from neighbors, all from yourself | $5–$40/mo plus your time |
Worth noticing: the managed-cloud row dodges two of this month’s three items entirely, because it has no cPanel and no Acronis cPanel plugin. That is not marketing — it is just a smaller stack. It is also four to ten times the price, which is why it is the wrong answer for a blog with 400 monthly visitors.
For most bloggers, the sensible upgrade is not “leave shared hosting.” It is “leave the cheapest tier of shared hosting,” where support is slowest and servers are densest. SiteGround is our pick there for patch cadence and support responsiveness, and there is a 30-day money-back guarantee if the support experience does not match the promise. If you have outgrown shared entirely, Kinsta is the no-cPanel option we point people to.
Our full reasoning on the tiers is in shared vs VPS vs managed WordPress hosting, and the head-to-head numbers live in our best web hosting for bloggers roundup.
Frequently asked questions
Was my blog hacked by one of these flaws?
Almost certainly not. Only one of the three — the Acronis backup plugin flaw — has confirmed exploitation, and Acronis described it as limited and targeted, based on a single customer report. All three also require an attacker to already have some access to the server. If your site is behaving normally, the realistic answer is no.
Do I need to update anything in WordPress because of this?
No. None of these three are WordPress plugins or themes. Keep WordPress updated for the usual reasons, but there is no WordPress-side patch for a cPanel, LiteSpeed or Acronis flaw. The fix is applied by your host, on the server.
How do I find out if my host uses LiteSpeed?
Two quick ways. If LiteSpeed Cache appears in your plugin list or your host recommends it, you are almost certainly on LiteSpeed. Otherwise, any HTTP header checker will show a “server” header reading LiteSpeed. Note that the header shows the product, not the build number — for the version you have to ask support.
Is managed WordPress hosting actually safer than shared hosting?
For this class of problem, usually yes — mostly because the stack is smaller and the accounts are better isolated, not because the company is more virtuous. Managed hosts have their own outages and their own incidents. You are buying a narrower attack surface and a faster maintenance schedule, not immunity.
Should I switch away from cPanel hosting?
Not on the strength of one bad fortnight. cPanel runs an enormous share of the web precisely because it is well understood, and “well understood” includes being well researched by security people — which is why flaws get found and patched rather than sitting silently. The stack you move to will have its own advisories; they will just be less familiar to you.
What does the CISA deadline mean for me?
Directly, nothing — the September 19 deadline binds US federal civilian agencies, not your blog. Indirectly it is a useful signal: CISA only adds vulnerabilities it has evidence are being exploited, and a three-day window is at the urgent end of its range.
The bottom line
Three server-level flaws in ten days is a busy stretch, not a crisis, and all three were patched by their vendors. The part worth keeping is the structural lesson: on shared hosting, the most important security decision you make is not a plugin setting. It is which company you trusted to run the machine.
So do the four small things — ask for build numbers, get a backup off the server, delete dormant mail accounts, turn on panel-level 2FA — and use the reply to that support ticket as the data point. A host that answers precisely has told you something no review, including ours, can tell you as well.
If the answer disappoints you, our best WordPress hosting for beginners comparison is the calm place to start looking, and Hostinger remains the budget pick we are comfortable naming for a first blog.
Sources
- The Hacker News — New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root (CVE-2026-67401)
- The Hacker News — LiteSpeed Enterprise Flaw Could Let One Hosting Account Gain Root Access on a Shared Server (September 15, 2026)
- The Hacker News — Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks (CVE-2026-87886)
- BleepingComputer — Acronis warns of actively exploited flaw in its cPanel backup plugin
- Help Net Security — Acronis backup plugin flaw exploited in targeted attacks (September 16, 2026)
- CISA — Known Exploited Vulnerabilities Catalog
- webhosting.today — Security coverage, September 2026
