Update: May 20, 2026

cPanel has released the security patches for this notice ahead of the originally scheduled release time. The patched builds are now available for affected versions of cPanel & WHM.

This release addresses multiple security issues, including vulnerabilities rated up to High severity. cPanel has identified the following items as addressed in this release:

• SEC-73728: cPanel & WHM / WP2 Security Update May 19, 2026
• SEC-73755: cPanel & WHM / WP2 Security Update May 19, 2026
• LiteSpeed User-End cPanel Plugin: A privilege-escalation vulnerability allowing unauthorized root access. cPanel has stated this issue is actively being exploited in the wild. As an interim security measure, cPanel has included an automated fix in this release that removes the plugin. Read the cPanel LiteSpeed plugin security notice .

Minimum Patched Builds

Servers should be updated to the appropriate patched build or later:

Reliable Penguin Response

Reliable Penguin is applying the available cPanel & WHM security updates across managed client servers. We strongly recommend that any affected servers not managed by Reliable Penguin be updated manually as soon as possible.

For servers managed by Reliable Penguin, no customer action is required unless we contact you directly regarding a maintenance window or special update requirement.

Where a manual update is required, the update can be applied with:

/scripts/upcp

Note for CentOS 6 or CloudLinux 6 systems: cPanel advises updating to the cl6110 branch, version 11.110.0.120, before manually updating.

We will continue monitoring this issue and will take any additional remediation steps as needed.

May 18, 2026

Reliable Penguin has been notified by cPanel that a cPanel & WHM security patch is expected to be released on Wednesday, May 20, 2026 at 8:00 AM Eastern Time.

According to cPanel, this release will address multiple vulnerabilities across several versions of cPanel & WHM, including vulnerabilities rated up to High severity.

cPanel has stated that there are currently no known exploits or proof-of-concept code in the wild. Technical details are expected to be released alongside the patches.

Affected Versions

The following cPanel & WHM versions are expected to be impacted:

• 86
• 94
• 102
• 110
• 110 (CL6)
• 118
• 124
• 126
• 130
• 132
• 134
• 136
• 136 (WP2)

Reliable Penguin Response

Reliable Penguin is reviewing managed cPanel & WHM servers for affected versions and will apply the security update once it becomes available.

For servers managed by Reliable Penguin, no customer action is required at this time unless we contact you directly regarding a maintenance window or special update requirements.

Next Steps

We will continue monitoring the release and will provide an update once the patch is available and remediation work is underway.