InfoSecBulletin Cybersecurity for mankind
CPanel has put out security updates to fix three problems in cPanel & WHM. These problems could let attackers take over WHM admin sessions or run commands as the root user. Organizations with affected systems should focus on upgrades. These problems impact all supported versions of cPanel & WHM before the new fixed versions.
cPanel & WHM Vulnerabilities
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
The biggest flaw, called CVE-2026-93698, affects the Multilang adminbin part. This weakness happens due to not checking inputs well enough, allowing anyone to run commands through the part.
Successful exploitation can let an attacker run code as the root user, the most powerful account on a Linux server, according to cPanel’s advisory.
The other two flaws, CVE-2026-93029 and CVE-2026-93697, are cross-site scripting (XSS) issues found in WHM admin interfaces. CVE-2026-93029 affects the Manage SSL Hosts interface, while CVE-2026-93697 affects the Mass Modify Accounts interface. Both issues let a regular user save harmful script content that runs when an admin opens the affected interface.
CPanel has fixed all three security issues in cPanel & WHM versions 11.110.0.148, 11.134.0.61, 11.136.0.45, and 11.138.0.11 or newer. WP Squared users need to update to version 11.138.1.13 or newer. The warnings were shared on September 29, 2026.
Administrators must quickly update affected servers to the latest patched version, not only the minimum fixed one. They should also check WHM access logs, special session activity, account changes, SSL host updates, and any unusual command uses for signs of post-exploitation activity.
GitLab
A serious flaw in GitLab’s AI Gateway might allow a logged-in user with Duo Agent Platform access to run commands on the gateway under some conditions, GitLab said in a notice. The gateway connects a GitLab instance to AI models. Only organizations with their own gateway need to take action. The problem is fixed in gateway versions 19.2.4, 19.3.2, and 19.4.1.
The flaw is called CVE-2026-90970. GitLab made it public on October 2 and said it is critical, giving it a CVSS score of 9.9 out of 10. GitLab has set up AI Gateways for its users and has already made them work well. Users on GitLab.com, GitLab Dedicated, and self-managed systems using a GitLab gateway do not need to do anything, the company noted.
Affected and Fixed Versions
The versions below are AI Gateway versions. The gateway is set up as a separate Docker image or Helm chart and has its own steps for updating.
Gateway version in use First fixed version
18.1.6 or later, before 19.2.4 19.2.4
19.3, before 19.3.2 19.3.2
19.4, before 19.4.1 19.4.1
Dell
Dell has issued security updates to fix several serious flaws in Dell Container Storage Modules (CSM). These flaws could be used by hackers to take control of weak systems.
The vulnerabilities are listed below:
CVE-2026-63688 (CVSS score: 10.0) – The vulnerability allows an attacker to get access to storage backend admin credentials for all registered storage arrays without needing to log in.
CVE-2026-63692 (CVSS score: 10.0) – A vulnerability in the authorization proxy and tenant service lets an attacker on the network gain admin-level access without logging in.
CVE-2026-67269 (CVSS score: 9.9) – A flaw in the ContainerStorageModule Custom Resource reconciler lets a low-level remote attacker gain higher privileges and access root-level control on cluster nodes.
CVE-2026-54472 (CVSS score: 9.8) – A vulnerability due to hard-coded passwords in the CSM Authorization module that allows a remote attacker without authentication to create fake admin tokens and get unauthorized access to the CSM Authorization proxy.
CVE-2026-61421 (CVSS score: 9.8) – A vulnerability in the JWT authentication component of karavi-authorization that allows someone without authorization to use a widely known signing secret to create fake authentication tokens and get admin access.
CVE-2026-67273 (CVSS score: 9.6) – A vulnerability in a template engine that allows a low-level attacker with remote access to gain higher privileges, steal sensitive information, and make unauthorized changes to role-based access controls.
“This vulnerability is considered critical as it enables a complete bypass of the csm-authorization security model, allowing an attacker to gain full administrative control over the storage infrastructure spanning all five supported Dell storage product families,” Dell said about CVE-2026-63688.
